- Nov 21, 2018
-
-
Matthew Hodgson authored
Fixes #7675 On macOS, if you call `connect()` on a UDP socket you cannot then call `sendto()` with a destination, otherwise it fails with Err#56 ('socket is already connected'). By calling `BIO_ctrl_set_connected()` on the wbio we can tell it that the socket has been connected and make it call `send()` rather than `sendto()`. Reviewed-by:Matt Caswell <matt@openssl.org> Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7676)
-
Andy Polyakov authored
Blinding is performed more efficiently and securely if MONT_CTX for public modulus is available by the time blinding parameter are instantiated. So make sure it's the case. Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7586)
-
- Nov 20, 2018
-
-
cclauss authored
CLA: trivial In Travis CI, add a Python linting step that runs flake8 tests in Travis CI to find syntax errors and undefined names. (http://flake8.pycqa.org ) __E901,E999,F821,F822,F823__ are the "_showstopper_" flake8 issues that can halt the runtime with a SyntaxError, NameError, etc. Most other flake8 issues are merely "style violations" -- useful for readability but they do not effect runtime safety. * F821: undefined name `name` * F822: undefined name `name` in `__all__` * F823: local variable name referenced before assignment * E901: SyntaxError or IndentationError * E999: SyntaxError -- failed to compile a file into an Abstract Syntax Tree Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7663)
-
- Nov 19, 2018
-
-
Richard Levitte authored
Mingw and Cygwin builds install the DLLs in the application directory, not the library directory, so ensure that one is created for them when installing the DLLs. Fixes #7653 Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7654)
-
- Nov 18, 2018
-
-
Johannes Bauer authored
Add documentation to new parameter and two examples showcasing scrypt KDF. Reviewed-by:
-
Johannes Bauer authored
This patch adds the ability to interactively enter passphrases for the pkeyutl application. For example, you could use $ openssl pkeyutl -kdf TLS1-PRF -kdflen 8 -pkeyopt md:md5 -pkeyopt_passin secret -pkeyopt_passin seed To have the "secret" and "seed" values read interactively from keyboard (with hidden input). Alternatively, the pass phrase argument syntax is also supported, e.g.: $ openssl pkeyutl -kdf TLS1-PRF -kdflen 8 -pkeyopt md:md5 -pkeyopt_passin secret:stdin -pkeyopt_passin seed:env:SEEDVAR To have "secret" read from stdin and "seed" from the environment variable SEEDVAR. Reviewed-by:
-
- Nov 16, 2018
-
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
- Nov 15, 2018
-
-
Richard Levitte authored
Without this precaution, we end up having directory targets depend on shlib object files for which there are no rules. Reviewed-by:
-
Richard Levitte authored
Fixes #7641 [extended tests] Reviewed-by:
-
Matt Caswell authored
A missing SSLfatal call can result in an assertion failed error if the condition gets triggered. Reviewed-by:
-
Antoine Salon authored
Signed-off-by:
Antoine Salon <asalon@vmware.com> Reviewed-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
- Nov 14, 2018
-
-
Matt Caswell authored
Reviewed-by:
-
- Nov 13, 2018
-
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
We therefore must add defaults. Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7626)
-
Richard Levitte authored
When libssl and libcrypto are compiled on Linux with "-rpath", but not "--enable-new-dtags", the RPATH takes precedence over LD_LIBRARY_PATH, and we end up running with the wrong libraries. This is resolved by using full (or at least relative, rather than just the filename to be found on LD_LIBRARY_PATH) paths to the shared objects. Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Richard Levitte authored
HTML comments aren't rendered, so markdown link syntax is irrelevant inside them, and more confusing than useful. Reviewed-by:
-
Richard Levitte authored
This will hopefully help directing our users to better user support resources as well as give some relevant advice in issue templates. https://help.github.com/articles/setting-up-your-project-for-healthy-contributions/ Reviewed-by:
-
- Nov 12, 2018
-
-
Viktor Dukhovni authored
SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: -
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
SSL(_CTX)?_set_client_CA_list() was a server side only function in 1.1.0. If it was called on the client side then it was ignored. In 1.1.1 it now makes sense to have a CA list defined for both client and server (the client now sends it the the TLSv1.3 certificate_authorities extension). Unfortunately some applications were using the same SSL_CTX for both clients and servers and this resulted in some client ClientHellos being excessively large due to the number of certificate authorities being sent. This commit seperates out the CA list updated by SSL(_CTX)?_set_client_CA_list() and the more generic SSL(_CTX)?_set0_CA_list(). This means that SSL(_CTX)?_set_client_CA_list() still has no effect on the client side. If both CA lists are set then SSL(_CTX)?_set_client_CA_list() takes priority. Fixes #7411 Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
TLSv1.3 is more restrictive about the curve used. There must be a matching sig alg defined for that curve. Therefore if we are using some other curve in our certificate then we should not negotiate TLSv1.3. Fixes #7435 Reviewed-by:
-
Richard Levitte authored
Setting the SipHash hash size and setting its key is done with two independent functions... and yet, the internals depend on both. Unfortunately, the function to change the size wasn't adapted for the possibility that the key was set first, with a different hash size. This changes the hash setting function to fix the internal values (which is easy, fortunately) according to the hash size. evpmac.txt value for digestsize:8 is also corrected. Reviewed-by:
-
- Nov 11, 2018
-
-
Dmitry Belyavskiy authored
Reviewed-by:
-
- Nov 10, 2018
-
-
Tomas Mraz authored
Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
-
Mansour Ahmadi authored
Reviewed-by:
Paul Yang <yang.yang@baishancloud.com> Reviewed-by:
-
Billy Brumley authored
Reviewed-by:
-
David Woodhouse authored
Rather than relying only on mandatory default digests, add a way for the EVP_PKEY to individually report whether each digest algorithm is supported. Reviewed-by:
-
