- 16 Jan, 2018 3 commits
-
-
Matt Caswell authored
I received this error from a TLSProxy test: Failed to start up server (localhost,4443): Transport endpoint is not connected So, extend the timeout before we give up trying to connect to the server. Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5088)
-
Matt Caswell authored
Commit 9f944291 changed the semantics of BN_copy() to additionally copy the BN_FLG_CONSTTIME flag if it is set. This turns out to be ill advised as it has unintended consequences. For example calling BN_mod_inverse_no_branch() can sometimes return a result with the flag set and sometimes not as a result. This can lead to later failures if we go down code branches that do not support constant time, but check for the presence of the flag. The original commit was made due to an issue in BN_MOD_CTX_set(). The original PR fixed the problem in that function, but it was changed in review to fix it in BN_copy() instead. The solution seems to be to revert the BN_copy() change and go back to the originally proposed way. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/5080)
-
Dr. Matthias St. Pierre authored
Fixes #5076 Since do_rand_drbg_init() allocates three locks, it needs to ensure that OPENSSL_init_crypto() is called, otherwise these resources are not cleaned up properly. Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5083)
-
- 15 Jan, 2018 2 commits
-
-
Richard Levitte authored
The same kind of failure that has already been observed on the s_client can sometimes also be observed on s_server, so we need to add the same kind of 50ms delay as was previously added on s_client. Ref: git commit cb2e10f2 : Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5079)
-
Richard Levitte authored
Only when building the main shared libraries Fixes #5075 Reviewed-by:
-
- 14 Jan, 2018 3 commits
-
-
Richard Levitte authored
This was identified for Windows almost two years ago for VC and msys/mingw. It seems that Cygwin suffers from the same issue, and since Cygwin doesn't define OPENSSL_SYS_WINDOWS, we need to make a special case to have a 50ms pause before closing the TLS connection. Ref: git commit cb2e10f2 Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
Bernd Edlinger authored
Reviewed-by:
-
- 13 Jan, 2018 1 commit
-
-
Bernd Edlinger authored
Reviewed-by:
-
- 12 Jan, 2018 1 commit
-
-
Pauli authored
This to avoid a clash with a #defined symbol on Solaris from time.h. Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5064)
-
- 10 Jan, 2018 2 commits
-
-
Patrick Schlangen authored
The data argument of SSL_dane_tlsa_add is used read-only, so it should be const. Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> Reviewed-by:
-
Dr. Matthias St. Pierre authored
- Avoid creating repeated year ranges <current_year>-<current_year> for documents which were added in the current year. - Use extended regular expressions for better readability (less quoting) - Use a shebang line which is more portable Reviewed-by:
-
- 09 Jan, 2018 5 commits
-
-
Matt Caswell authored
In the case of a protocol version alert being sent by a peer the record version number may not be what we are expecting. In DTLS records with an unexpected version number are silently discarded. This probably isn't appropriate for alerts, so we tolerate a mismatch in the minor version number. This resolves an issue reported on openssl-users where an OpenSSL server chose DTLS1.0 but the client was DTLS1.2 only and sent a protocol_version alert with a 1.2 record number. This was silently ignored by the server. Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Todd Short authored
Found with gcc 4.8.4 Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
David von Oheimb authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
-
- 08 Jan, 2018 13 commits
-
-
Christian Heimes authored
Closes: https://github.com/openssl/openssl/issues/4897 Signed-off-by:
Christian Heimes <christian@python.org> Reviewed-by:
-
Tomas Mraz authored
This avoids situations where third party client is unable to recognize that the client certificate was issued by the same CA with name differring only by case or insignificant characters. Reviewed-by:
-
Patrick Steuer authored
In man1/engine.pod and man3/ENGINE_add.pod Reviewed-by:
-
Patrick Steuer authored
Signed-off-by:
Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by:
-
Jacob Hoffman-Andrews authored
Many of the sub-commands under apps/ accept cipher or digest arguments like "-sha256". These are implemented using a catchall flag that runs the result through opt_md() or opt_cipher(). That means any unrecognized flag, including typos, gets sent to those two functions, producing confusing error messages like below: $ ./apps/openssl req -x590 req: Unrecognized digest x590 req: Use -help for summary. This change switches these two functions to say "Unrecognized flag X" instead. The new message deliberately leaves off the "-" from the flag name, because there are some cases where opt_md() and opt_cipher() are passed a flag value instead (for instance, openssl ca -md). I think the new message is generic enough that it can serve both cases with improved clarity. CLA: trivial Reviewed-by: -
EasySec authored
Reviewed-by:
-
pass86 authored
CLA: trivial Reviewed-by:
-
Noah Robbin authored
Extract the RSA key using EVP_PKEY_get0. Type is checked externally to be either EVP_PKEY_RSA_PSS or EVP_PKEY_RSA. Reviewed-by:
-
Noah Robbin authored
Reviewed-by:
-
Dmitry Belyavskiy authored
Reviewed-by:
-
Dr. Matthias St. Pierre authored
usage: openssl-update-copyright [-h|--help] [file|directory] ... Updates the year ranges of all OpenSSL copyright statements in the given files or directories. (Directories are traversed recursively.) Only copyright statements containing the string 'The OpenSSL Project' are affected. The copyright time range is adjusted to include the current year. If only a single year was specified, it is replaced by a time range starting at that year and ending at the current year. All '(c)' and '(C)' signs are preserved. Signed-off-by:
Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
-
Richard Levitte authored
So far, we've placed all extra library related flags together, ending up in the make variable EX_LIBS. This turns out to be problematic, as for example, some compilers don't quite agree with something like this: cc -o foo foo.o -L/whatever -lsomething They prefer this: cc -L/whatever -o foo foo.o -lsomething IBM's compiler on OS/390 is such a compiler that we know of, and we have previously handled that as a previous case. The answer here is to make a more general solution, where linking options are divided in two parts, where one ends up in LDFLAGS and the other in EX_LIBS (they corresponds to what is called LDFLAGS and LDLIBS in the GNU world) Reviewed-by: -
Richard Levitte authored
The uClinux targets included some attributes that would result in circular references of CFLAGS and LDCLAGS. Reviewed-by:
-
- 07 Jan, 2018 10 commits
-
-
Rich Salz authored
Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Patrick Steuer authored
Signed-off-by:
-
Patrick Steuer authored
Signed-off-by:
-
Patrick Steuer authored
Signed-off-by:
-
Andy Polyakov authored
SPARC ISA doesn't have provisions to back up 128-bit multiplications and additions. And so multiplications are done with library calls and carries with comparisons and conditional moves. As result base 2^51 code is >40% slower... Reviewed-by: -
Andy Polyakov authored
[and improve formatting] Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
This is based on RT#3810, which added dedicated modular inversion. ECDSA verify results improves as well, but not as much. Reviewed-by:
-
