- 07 Nov, 2018 2 commits
-
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7532)
-
Richard Levitte authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7545) (cherry picked from commit 3866b224)
-
- 05 Nov, 2018 8 commits
-
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7531) (cherry picked from commit 2bb1b5dd)
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7518)
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7519)
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7519)
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7519)
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7519)
-
Pauli authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7564) (cherry picked from commit 20870286)
-
Pauli authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7564) (cherry picked from commit e931f370)
-
- 04 Nov, 2018 2 commits
-
-
Benjamin Kaduk authored
Commit 9ef9088c switched the SSL/SSL_CTX statistics counters to using Thread-Sanitizer-friendly primitives. However, it erroneously converted an addition of -1 (for s->session_ctx->stats.sess_accept) to an addition of +1, since that is the only counter API provided by the internal tsan_assist.h header until the previous commit. This means that for each accepted (initial) connection, the session_ctx's counter would get doubly incremented, and the (switched) ctx's counter would also get incremented. Restore the counter decrement so that each accepted connection increments exactly one counter exactly once (in net effect). Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7464) (cherry picked from commit 2aaa0b14)
-
Benjamin Kaduk authored
The existing tsan_counter() API increments a reference counter. Provide a new API, tsan_decr(), to decrement such a reference counter. This can be used, for example, when a reference is added to the session_ctx's sess_accept stats but should more properly be tracked in the regular ctx's statistics. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7464) (cherry picked from commit 95658c32)
-
- 02 Nov, 2018 5 commits
-
-
Richard Levitte authored
If engine building fails for some reason, we must make sure to close the /dev/crypto handle. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7506) (cherry picked from commit 681e8cac)
-
Richard Levitte authored
We opened /dev/crypto once for each session, which is quite unnecessary. With this change, we open /dev/crypto once at engine init, and close it on unload. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7506) (cherry picked from commit 458c7dad)
-
Richard Levitte authored
Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7506) (cherry picked from commit 28ac1bd9)
-
Richard Levitte authored
Copying an EVP_MD_CTX, including the implementation local bits, is a necessary operation. In this case, though, it's the same as initializing the local bits to be "copied to". Fixes #7495 Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7506) (cherry picked from commit 36af124b)
-
Richard Levitte authored
The documentation says some commands care, but the code says differently. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7440) (cherry picked from commit d91d443f)
-
- 01 Nov, 2018 1 commit
-
-
Pauli authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7549) (cherry picked from commit 00496b64)
-
- 31 Oct, 2018 3 commits
-
-
Richard Levitte authored
This makes sure that any resulting directory target in the build files also depend on object files meant for shared libraries. As a side effect, we move the production of the dirinfo structure from common.tmpl to Configure, to make it easier to check the result. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7452) (cherry picked from commit b6e660754c2e799cffe4906269fcace0e07c73bc)
-
Andy Polyakov authored
This excluses user from additional PATH adjustments in case NDK has llvm-ar. Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7443) (cherry picked from commit ddf2e8c8)
-
Andy Polyakov authored
03ad7c00 failed if one didn't pass explicit -D__ANDROID_API__=N :-( Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7443) (cherry picked from commit 71f2b317)
-
- 30 Oct, 2018 5 commits
-
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7523) (cherry picked from commit 4011bab1)
-
Matt Caswell authored
Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7413) (cherry picked from commit 6e46c065)
-
Matt Caswell authored
In TLSv1.2 and below a CertificateRequest is sent after the Certificate from the server. This means that by the time the client_cert_cb is called on receipt of the CertificateRequest a call to SSL_get_peer_certificate() will return the server certificate as expected. In TLSv1.3 a CertificateRequest is sent before a Certificate message so calling SSL_get_peer_certificate() returns NULL. To workaround this we delay calling the client_cert_cb until after we have processed the CertificateVerify message, when we are doing TLSv1.3. Fixes #7384 Reviewed-by:
Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/7413) (cherry picked from commit e4562014)
-
Dr. Matthias St. Pierre authored
The RAND_DRBG_TYPE preprocessor define depends on a NID, so we have to include obj_mac.h to make the header selfcontained. Fixes #7521 Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7524) (cherry picked from commit cf3d6ef7)
-
Chocobo1 authored
CLA: trivial Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7444) (cherry picked from commit cf4eea12)
-
- 29 Oct, 2018 8 commits
-
-
Richard Levitte authored
pkey_test_ctrl() was designed for parsing values, not for using in test runs. Relying on its returned value when it returned 1 even for control errors made it particularly useless for mac_test_run(). Here, it gets replaced with a MAC specific control function, that parses values the same way but is designed for use in a _run() rather than a _parse() function. This uncovers a SipHash test with an invalid control that wasn't caught properly. After all, that stanza is supposed to test that invalid control values do generate an error. Now we catch that. Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7500) (cherry picked from commit ce5d64c7)
-
Matt Caswell authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7501) (cherry picked from commit 10d5b415)
-
Matt Caswell authored
Fixes #7497 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7501) (cherry picked from commit ca55d70b)
-
Richard Levitte authored
We made the build of foo.obj depend on foo.d, meaning the latter gets built first. Unfortunately, the way the compiler works, we are forced to redirect all output to foo.d, meaning that if the source contains an error, the build fails without showing those errors. We therefore remove the dependency and force the build of foo.d to always happen after build of foo.obj. Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7469) (cherry picked from commit ecc347f5)
-
Richard Levitte authored
Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7194) (cherry picked from commit 60690b5b)
-
Richard Levitte authored
Needed to clear a clash between ERR_load_CRYPTO_strings and ERR_load_crypto_strings Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7194) (cherry picked from commit cc3a2e4f)
-
Richard Levitte authored
Believe it or not, the VMS C compiler is remarking on this Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7194) (cherry picked from commit 4602cc85aff35b7aa5e27dc57ead89f0867637f9)
-
Bernd Edlinger authored
Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7504) (cherry picked from commit f9e43929c46b38667f67e02765fe0f1c0d3061d6)
-
- 28 Oct, 2018 6 commits
-
-
Dr. Matthias St. Pierre authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7510) (cherry picked from commit 040a03470c7c5bf95fe8e6143db7bef357a22833)
-
Pauli authored
Preallocate an extra limb for some of the big numbers to avoid a reallocation that can potentially provide a side channel. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7486) (cherry picked from commit 99540ec79491f59ed8b46b4edf130e17dc907f52)
-
Pauli authored
Avoid a timing attack that leaks information via a side channel that triggers when a BN is resized. Increasing the size of the BNs prior to doing anything with them suppresses the attack. Thanks due to Samuel Weiser for finding and locating this. Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7486) (cherry picked from commit a9cfb8c2aa7254a4aa6a1716909e3f8cb78049b6)
-
Pauli authored
There is a side channel attack against the division used to calculate one of the modulo inverses in the DSA algorithm. This change takes advantage of the primality of the modulo and Fermat's little theorem to calculate the inverse without leaking information. Thanks to Samuel Weiser for finding and reporting this. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7487) (cherry picked from commit 415c33563528667868c3c653a612e6fc8736fd79)
-
Dr. Matthias St. Pierre authored
Found by Coverity Scan Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7511) (cherry picked from commit 59f90557)
-
Richard Levitte authored
This also gave enough reason to collect the stuff that's common for all iOS config targets into the template "ios-common". Fixes #7318 Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7403) (cherry picked from commit 04e3f9a114c2c142356ef1639d68397a72e0c7f8)
-