- Jul 14, 2017
-
-
Roelof duToit authored
This resolves the retry issue in general, but also the specific case where a TLS 1.3 server sends a post-handshake NewSessionTicket message prior to appdata. Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
-
- May 04, 2017
-
-
Matt Caswell authored
The previous commits added sanity checks for where the max enabled protocol version does not have any configured ciphersuites. We should check that we fail in those circumstances. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3334)
-
Matt Caswell authored
Ensure that there are ciphersuites enabled for the maximum supported version we will accept in a ClientHello. Reviewed-by:
-
Matt Caswell authored
Ensure that there are ciphersuites enabled for the maximum supported version we are claiming in the ClientHello. Reviewed-by:
-
- Mar 21, 2017
-
-
Matt Caswell authored
Make sure we actually test resumption where an HRR has occurred. Reviewed-by:
-
Matt Caswell authored
Commit 6b1bb98f moved the processing of ClientHello extensions into the state machine post-processing stage. After processing s->init_num is reset to 0, so by post-processing we cannot rely on its value. Unfortunately we were using it to handle the PSK extension. This causes the handshake to fail. We were using init_num to figure out the length of ClientHello2 so we can remove it from the handshake_buffer. The handshake_buffer holds the transcript of all the messages sent so far. For PSK processing though we only want to add in a partial ClientHello2. This commit changes things so we just work out where ClientHello2 starts, working forward from the beginning of handshake_buffer. Fixes #2983 Reviewed-by:
-
- Mar 16, 2017
-
-
Paul Yang authored
For the function that get the changed fds, it should be 'ASYNC_WAIT_CTX_get_changed_fds()' instead of 'ASYNC_WAIT_CTX_fds_have_changed()'. CLA: trivial Signed-off-by:
Paul Yang <paulyang.inf@gmail.com> Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
-
FdaSilvaYY authored
clean an useless static qualifier and a dead comment. Reviewed-by:
-
Benjamin Kaduk authored
It's even removing a BUGS entry! Reviewed-by:
Emilia Käsper <emilia@openssl.org> Reviewed-by:
-
Benjamin Kaduk authored
Some things were not removed from util/indent.pro when they were removed from the code. grep '^-T' util/indent.pro | awk '{print $2} > /tmp/a grep -rF -f /tmp/a --exclude CHANGES --exclude 'INSTALL' --exclude 'LICENSE' --exclude 'NEWS' --exclude 'NOTES*' --exclude 'README*' --exclude indent.pro --exclude-dir corpora -o -h *|sort|uniq>/tmp/b comm -23 <(sort /tmp/a) /tmp/b >/tmp/c grep -v -E '(LHASH_OF|STACK_OF)' /tmp/c > /tmp/d grep -v -Ff /tmp/d util/indent.pro > util/indent.pro Manually adjusted to retain time_t and the ossl_*intmax_t types. Reviewed-by: -
Benjamin Kaduk authored
Reviewed-by:
-
Pauli authored
tests. [skip ci] Reviewed-by:
-
- Mar 15, 2017
-
-
Bernd Edlinger authored
Reviewed-by:
-
Benjamin Kaduk authored
tls1_get_curvelist() does not read from its third parameter, so the assignments prior to function call were dead code and can be removed. Reviewed-by:
-
Benjamin Kaduk authored
Instead of making a positive comparison against the invalid value that our server would send, make a negative check against the only value that is not an error. Reviewed-by:
-
Richard Levitte authored
Reviewed-by: -
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
Just as for DH, DSA and RSA, this gives the engine associated with the key. Reviewed-by:
-
Pauli authored
describe the vagaries in their behaviour. [skip ci] Reviewed-by:
-
Pauli authored
Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
-
Matt Caswell authored
The logic for testing whether the sessionfile has been created or not was faulty and could result in race conditions. If you "lose" the tests hang waiting for a session file that's never going to arrive. Fixes #2950 Reviewed-by:
-
Andy Polyakov authored
Reviewed-by: -
Andy Polyakov authored
Strawberry Perl bailed out running test\run_tests.pl insisting on setup() being called explicitly. Reviewed-by: -
Benjamin Kaduk authored
Zero out the length alongside the NULLing of the pointer, to bring parity between the selected and proposed fields.. Reviewed-by:
-
Richard Levitte authored
It turns out that /DSF didn't do any good for our purposes. Instead, remove the CALL_DEBUG flag from any image we link. This ensures that we can have debugging information in the image files, but don't automatically end up in a debugging session upon image activation. Unfortunately, this means the CALL_DEBUG must be turned on when there is a need to run with the debugger activated, and to turn it off when done. This has been documented in NOTES.VMS. Reviewed-by:
-
Jon Spillett authored
Add python cryptography testing instructions too Reviewed-by:
-
Dr. Stephen Henson authored
Import test data from: ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip This is a set of RSA-PSS and RSA-OAEP test vectors including some edge cases with unusual key sizes. Reviewed-by:
-
- Mar 14, 2017
-
-
Matt Caswell authored
The previous 2 commits fixed some issues in the Boring tests. This re-enables those tests. [extended tests] Reviewed-by:
-
Matt Caswell authored
After a resumption it is documented that SSL_get_peer_cert_chain() will return NULL. In BoringSSL it still returns the chain. We don't support that so we should update the shim to call SSL_get_peer_certificate() instead when checking whether a peer certificate is available. Reviewed-by:
-
Matt Caswell authored
OpenSSL requires that we set the session id context. BoringSSL apparently does not require this, so wasn't setting it. Reviewed-by:
-
Benjamin Kaduk authored
No need to break out of the loop and repeat the loop termination condition when we can just return. Reviewed-by:
Kurt Roeckx <kurt@openssl.org> Reviewed-by:
-
Richard Levitte authored
[.util]shareable_image_wrap.c.in was never useful because lib$spawn() insisted on combining stdout and stderr into one. Instead, we introduce two scripts that create and destroy a temporary environment where the local shareable images become available, [.util]local_shlib.com and [.util]unlocal_shlib.com. They also define DBG$IMAGE_DSF_PATH, which is require so the debugger can find the Debug Symbol Files. Reviewed-by:
-
Richard Levitte authored
That makes it possible to run images without automagically ending up in a debug session, while still being able to debug when required. All .DSF files must reside in the same directory to be useful. Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
Rich Salz authored
Using a cert with Cyrillic characters, kindly supplied by Dmitry Belyavsky Reviewed-by:
-
Emilia Kasper authored
This gets us a newer Clang, and newer Go. 1.1.0 already runs on Trusty without issues. To do this, we need to disable afalgeng in the -Werror build. afalgeng isn't compatible with the -Werror build on Travis Trusty due to kernel header mismatch. (See also 97043e46 ) Reviewed-by:
-
Benjamin Kaduk authored
Reviewed-by:
-
Benjamin Kaduk authored
Found using various (old-ish) versions of gcc. Reviewed-by:
-
Richard Levitte authored
On some platforms, setting stdout to binary mode isn't quite enough, which makes the result unusable. With -out, we have better control. Reviewed-by:
-
Matt Caswell authored
The Boring runner attempts to enable the NULL-SHA ciphersuite using the cipherstring "DEFAULT:NULL-SHA". However in OpenSSL DEFAULT permanently switches off NULL ciphersuites, so we fix this up to be "ALL:NULL-SHA" instead. We can't change the runner so we have to change the shim to detect this. (Merged from https://github.com/openssl/openssl/pull/2933 ) Reviewed-by:
-
