Skip to content
  1. May 22, 2015
    • Matt Caswell's avatar
      Ignore files from other branches · 8757bf83
      Matt Caswell authored
      
      
      There are a number of files that are created on other branches that are
      not held in git and are not needed in master. When checking out master
      after working on another branch these files show up in "git status", so
      just add them to .gitignore
      
      Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
      8757bf83
    • Lubom's avatar
      Lost alert in DTLS · 4dc1aa04
      Lubom authored
      
      
      If a client receives a bad hello request in DTLS then the alert is not
      sent correctly.
      
      RT#2801
      
      Signed-off-by: default avatarMatt Caswell <matt@openssl.org>
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      4dc1aa04
    • Matt Caswell's avatar
      Fix various OPENSSL_NO_* options · a7f82a1a
      Matt Caswell authored
      
      
      This fixes compilation with various OPENSSL_NO_* options that got broken
      during the big apps cleanup.
      
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      a7f82a1a
    • Matt Caswell's avatar
      Fix a memory leak in compression · 6b41b3f5
      Matt Caswell authored
      
      
      The function RECORD_LAYER_clear() is supposed to clear the contents of the
      RECORD_LAYER structure, but retain certain data such as buffers that are
      allocated. Unfortunately one buffer (for compression) got missed and was
      inadvertently being wiped, thus causing a memory leak.
      
      In part this is due to the fact that RECORD_LAYER_clear() was reaching
      inside SSL3_BUFFERs and SSL3_RECORDs, which it really shouldn't. So, I've
      rewritten it to only clear the data it knows about, and to defer clearing
      of SSL3_RECORD and SSL3_BUFFER structures to SSL_RECORD_clear() and the
      new function SSL3_BUFFER_clear().
      
      Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
      Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
      6b41b3f5
  2. May 21, 2015
  3. May 20, 2015
  4. May 19, 2015
  5. May 18, 2015
  6. May 17, 2015
  7. May 16, 2015
    • Matt Caswell's avatar
      Further version negotiation updates · b2ce0337
      Matt Caswell authored
      
      
      More miscellaneous updates to version negotiation following feedback.
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      b2ce0337
    • Matt Caswell's avatar
      Move SSLv3_*method() functions · a304d385
      Matt Caswell authored
      
      
      Move these functions into t1_clnt.c, t1_srvr.c and t1_meth.c and take
      advantage of the existing tls1_get*_method() functions that all the other
      methods are using. Since these now have to support SSLv3 anyway we might
      as well use the same set of get functions for both TLS and SSLv3.
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      a304d385
    • Matt Caswell's avatar
      Updates following review comments · d45ba43d
      Matt Caswell authored
      
      
      Miscellaneous updates following review comments on the version negotiation
      rewrite patches.
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      d45ba43d
    • Matt Caswell's avatar
      Version negotiation rewrite doc updates · a27e81ee
      Matt Caswell authored
      
      
      Update various documentation references to the new TLS_*_method names. Also
      add a CHANGES entry.
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      a27e81ee
    • Matt Caswell's avatar
      Version negotiation rewrite cleanup · a3680c8f
      Matt Caswell authored
      
      
      Following the version negotiation rewrite all of the previous code that was
      dedicated to version negotiation can now be deleted - all six source files
      of it!!
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      a3680c8f
    • Matt Caswell's avatar
      Client side version negotiation rewrite · 13c9bb3e
      Matt Caswell authored
      
      
      Continuing from the previous commit this changes the way we do client side
      version negotiation. Similarly all of the s23* "up front" state machine code
      has been avoided and again things now work much the same way as they already
      did for DTLS, i.e. we just do most of the work in the
      ssl3_get_server_hello() function.
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      13c9bb3e
    • Matt Caswell's avatar
      Server side version negotiation rewrite · 32ec4153
      Matt Caswell authored
      
      
      This commit changes the way that we do server side protocol version
      negotiation. Previously we had a whole set of code that had an "up front"
      state machine dedicated to the negotiating the protocol version. This adds
      significant complexity to the state machine. Historically the justification
      for doing this was the support of SSLv2 which works quite differently to
      SSLv3+. However, we have now removed support for SSLv2 so there is little
      reason to maintain this complexity.
      
      The one slight difficulty is that, although we no longer support SSLv2, we
      do still support an SSLv3+ ClientHello in an SSLv2 backward compatible
      ClientHello format. This is generally only used by legacy clients. This
      commit adds support within the SSLv3 code for these legacy format
      ClientHellos.
      
      Server side version negotiation now works in much the same was as DTLS,
      i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to
      that then when a ClientHello is received it will work out the most
      appropriate version to respond with. Also, SSLv23_method and
      SSLv23_server_method have been replaced with TLS_method and
      TLS_server_method respectively. The old SSLv23* names still exist as
      macros pointing at the new name, although they are deprecated.
      
      Subsequent commits will look at client side version negotiation, as well of
      removal of the old s23* code.
      
      Reviewed-by: default avatarKurt Roeckx <kurt@openssl.org>
      32ec4153
  8. May 15, 2015
  9. May 14, 2015