- Nov 03, 2016
-
-
Richard Levitte authored
- Make sure to initialise SHLIB variables - Make sure to make local variables static Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1838) (cherry picked from commit 3b0478fe)
-
Richard Levitte authored
gcc is kinder, it silently passes quite a few flags to ld, while clang is stricter and wants them prefixed with -Wl, Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1836) (cherry picked from commit 075e9da0)
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1832) (cherry picked from commit 9c89c846)
-
Kurt Roeckx authored
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1828 (cherry picked from commit ea6199ea)
-
Mike Aizatsky authored
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1788 (cherry picked from commit ba740700)
-
- Nov 02, 2016
-
-
Matt Caswell authored
Rather than leaking a reference, just call GetModuleHandleEx and pin the module on Windows. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 2b59d1be)
-
Matt Caswell authored
Instead of deliberately leaking a reference to ourselves, use nodelete which does this more neatly. Only for Linux at the moment. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit b6d5ba1a)
-
Matt Caswell authored
This should demonstrate that the atexit() handling is working properly (or at least not crashing) on process exit. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit b987d748)
-
Matt Caswell authored
Because we use atexit() to cleanup after ourselves, this will cause a problem if we have been dynamically loaded and then unloaded again: the atexit() handler may no longer be there. Most modern atexit() implementations can handle this, however there are still difficulties if libssl gets unloaded before libcrypto, because of the atexit() callback that libcrypto makes to libssl. The most robust solution seems to be to ensure that libcrypto and libssl never unload. This is done by simply deliberately leaking a dlopen() reference to them. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 5836780f)
-
Matt Caswell authored
This works the same way as DSO_pathbyaddr() but instead returns a ptr to the DSO that contains the provided symbol. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit b39eda7e)
-
Matt Caswell authored
Commit 3d8b2ec4 removed various unused functions. However now we need to use one of them! This commit resurrects DSO_pathbyaddr(). We're not going to resurrect the Windows version though because what we need to achieve can be done a different way on Windows. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit cb6ea61c)
-
Matt Caswell authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit ce95f3b7)
-
Matt Caswell authored
We should fail if we receive an unrecognised record type Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 1f3e70a4)
-
Matt Caswell authored
TLS1.0 and TLS1.1 say you SHOULD ignore unrecognised record types, but TLS 1.2 says you MUST send an unexpected message alert. We swap to the TLS 1.2 behaviour for all protocol versions to prevent issues where no progress is being made and the peer continually sends unrecognised record types, using up resources processing them. Issue reported by 郭志攀 Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 436a2a01)
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1815) (cherry picked from commit 2c4a3f93)
-
Sergey Bronnikov authored
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1801) (cherry picked from commit fe2582a2)
-
Matt Caswell authored
This test checks that read_ahead works correctly when dealing with large records. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 7856332e)
-
Matt Caswell authored
The function ssl3_read_n() takes a parameter |clearold| which, if set, causes any old data in the read buffer to be forgotten, and any unread data to be moved to the start of the buffer. This is supposed to happen when we first read the record header. However, the data move was only taking place if there was not already sufficient data in the buffer to satisfy the request. If read_ahead is set then the record header could be in the buffer already from when we read the preceding record. So with read_ahead we can get into a situation where even though |clearold| is set, the data does not get moved to the start of the read buffer when we read the record header. This means there is insufficient room in the read buffer to consume the rest of the record body, resulting in an internal error. This commit moves the |clearold| processing to earlier in ssl3_read_n() to ensure that it always takes place. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit a7faa6da)
-
Richard Levitte authored
Forks will have to define their own Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1821) (cherry picked from commit 5e28b1c1)
-
- Nov 01, 2016
-
-
Benjamin Kaduk authored
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1625) (cherry picked from commit e4d94269)
-
- Oct 31, 2016
-
-
Richard Levitte authored
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1802) (cherry picked from commit f46661de)
-
Richard Levitte authored
Fixes #1781 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1813) (cherry picked from commit ebca7961)
-
Richard Levitte authored
VC-noCE-common and VC-WIN64-common were missing this line: template => 1, Fixes GH#1809 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1811) (cherry picked from commit be1f4812)
-
- Oct 28, 2016
-
-
Matt Caswell authored
Replace the various length checks in the extension code with a macro to simplify the logic. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
The previous commit inspired a review of all the length checks for the extension adding code. This adds more robust checks and adds checks where some were missing previously. The real solution for this is to use WPACKET which is currently in master - but that cannot be applied to release branches. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
The status request extension did not correctly check its length, meaning that writing the extension could go 2 bytes beyond the buffer size. In practice this makes little difference because, due to logic in buffer.c the buffer is actually over allocated by approximately 5k! Issue reported by Guido Vranken. Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Providing a spkac file with no default section causes a double free. Thanks to Brian Carpenter for reporting this issue. Reviewed-by: Kurt Roeckx <kurt@openssl.org> (cherry picked from commit 229bd124)
-
Matt Caswell authored
A BIO_read() 0 return indicates that a failure occurred that may be retryable. An SSL_read() 0 return indicates a non-retryable failure. Check that if BIO_read() returns 0, SSL_read() returns <0. Same for SSL_write(). The asyncio test filter BIO already returns 0 on a retryable failure so we build on that. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit a34ac5b8)
-
Matt Caswell authored
A zero return from BIO_read()/BIO_write() could mean that an IO operation is retryable. A zero return from SSL_read()/SSL_write() means that the connection has been closed down (either cleanly or not). Therefore we should not propagate a zero return value from BIO_read()/BIO_write() back up the stack to SSL_read()/SSL_write(). This could result in a retryable failure being treated as fatal. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 4880672a)
-
- Oct 26, 2016
-
-
Richard Levitte authored
The current version of the VMS compiler provides C99 features, strictly language wise. Unfortunately, even the most recent standard library isn't fully updated for that standard, so we need to use an earlier standard that the compiler supports. Most importantly, this affects the __STDC_VERSION__ value, which the compiler unfortunately currently defaults to 199901L. With this change we won't have to give VMS special treatment when looking for features based on that macro. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1785) (cherry picked from commit 4f3015bb)
-
Rich Salz authored
Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 12a7715e)
-
- Oct 25, 2016
-
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1767) (cherry picked from commit 78ce90cb)
-
Richard Levitte authored
This is overdue since the addition of the unified build system Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1767) (cherry picked from commit 4fa3f08f)
-
- Oct 24, 2016
-
-
Andy Polyakov authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit ace05265)
-
- Oct 22, 2016
-
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1768) (cherry picked from commit 4fab3e24)
-
- Oct 21, 2016
-
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1759) (cherry picked from commit 92403e77)
-
Claus Assmann authored
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1762) (cherry picked from commit 8b5fffc8)
-
Rich Salz authored
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1584) (cherry picked from commit a8a8a917)
-
- Oct 20, 2016
-
-
David Woodhouse authored
I use the word 'negotiation' advisedly. Because that's all we were doing. We negotiated it, set the TLS1_FLAGS_ENCRYPT_THEN_MAC flag in our data structure, and then utterly ignored it in both dtls_process_record() and do_dtls1_write(). Turn it off for 1.1.0; we'll fix it for 1.1.1 and by the time that's released, hopefully 1.1.0b will be ancient history. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643) (cherry picked from commit b85bf639)
-