- Nov 24, 2018
-
-
Richard Levitte authored
When creating a tarball, it's pointless to include scripts that assume a git workspace. Reviewed-by:
Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7696)
-
Richard Levitte authored
Also adds missing copyright boilerplate to util/mktar.sh Reviewed-by:
-
Richard Levitte authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7700)
-
Richard Levitte authored
This typo prevented ia64 assembler to be compiled on VMS Reviewed-by:
-
Richard Levitte authored
It turns out that on VMS, strerror() returns messages with added spaces at the end. We wouldn't had noticed if it wasn't for perl trimming those spaces off for its own sake and thereby having test/recipes/02-test_errstr.t fail on VMS. The safe fix is to do the same trimming ourselves. Reviewed-by:
Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7701)
-
- Nov 23, 2018
-
-
Richard Levitte authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7692)
-
Richard Levitte authored
Since recently, OpenSSL tarballs are produced with 'make tar' rather than 'make dist', as the latter has turned out to be more troublesome than useful. The next step to look at is why we would need to configure at all to produce a Makefile just to produce a tarball. After all, the tarball should now only contain source files that are present even without configuring. Furthermore, the current method for producing tarballs is a bit complex, and can be greatly simplified with the right tools. Since we have everything versioned with git, we might as well use the tool that comes with it. Added: util/mktar.sh, a simple script to produce OpenSSL tarballs. It takes the options --name to modify the prefix of the distribution, and --tarfile tp modify the tarball file name specifically. This also adds a few entries in .gitattributes to specify files that should never end up in a distribution tarball. Reviewed-by:
-
Richard Levitte authored
This ensures we collected them properly and and as completely as can be tested safely. Reviewed-by:
-
Richard Levitte authored
We stored copies of the system error texts in a fixed line size array, which is a huge waste. Instead, use a static memory pool and pack all the string in there. The wasted space at the end, if any, gives us some leeway for longer strings than we have measured so far. Reviewed-by:
-
- Nov 21, 2018
-
-
Matthew Hodgson authored
Fixes #7675 On macOS, if you call `connect()` on a UDP socket you cannot then call `sendto()` with a destination, otherwise it fails with Err#56 ('socket is already connected'). By calling `BIO_ctrl_set_connected()` on the wbio we can tell it that the socket has been connected and make it call `send()` rather than `sendto()`. Reviewed-by: -
Andy Polyakov authored
Blinding is performed more efficiently and securely if MONT_CTX for public modulus is available by the time blinding parameter are instantiated. So make sure it's the case. Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7586)
-
- Nov 20, 2018
-
-
cclauss authored
CLA: trivial In Travis CI, add a Python linting step that runs flake8 tests in Travis CI to find syntax errors and undefined names. (http://flake8.pycqa.org ) __E901,E999,F821,F822,F823__ are the "_showstopper_" flake8 issues that can halt the runtime with a SyntaxError, NameError, etc. Most other flake8 issues are merely "style violations" -- useful for readability but they do not effect runtime safety. * F821: undefined name `name` * F822: undefined name `name` in `__all__` * F823: local variable name referenced before assignment * E901: SyntaxError or IndentationError * E999: SyntaxError -- failed to compile a file into an Abstract Syntax Tree Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7663)
-
- Nov 19, 2018
-
-
Richard Levitte authored
Mingw and Cygwin builds install the DLLs in the application directory, not the library directory, so ensure that one is created for them when installing the DLLs. Fixes #7653 Reviewed-by:
-
- Nov 18, 2018
-
-
Johannes Bauer authored
Add documentation to new parameter and two examples showcasing scrypt KDF. Reviewed-by:
-
Johannes Bauer authored
This patch adds the ability to interactively enter passphrases for the pkeyutl application. For example, you could use $ openssl pkeyutl -kdf TLS1-PRF -kdflen 8 -pkeyopt md:md5 -pkeyopt_passin secret -pkeyopt_passin seed To have the "secret" and "seed" values read interactively from keyboard (with hidden input). Alternatively, the pass phrase argument syntax is also supported, e.g.: $ openssl pkeyutl -kdf TLS1-PRF -kdflen 8 -pkeyopt md:md5 -pkeyopt_passin secret:stdin -pkeyopt_passin seed:env:SEEDVAR To have "secret" read from stdin and "seed" from the environment variable SEEDVAR. Reviewed-by:
-
- Nov 16, 2018
-
-
Andy Polyakov authored
Reviewed-by:
-
Andy Polyakov authored
Reviewed-by:
-
- Nov 15, 2018
-
-
Richard Levitte authored
Without this precaution, we end up having directory targets depend on shlib object files for which there are no rules. Reviewed-by:
-
Richard Levitte authored
Fixes #7641 [extended tests] Reviewed-by:
-
Matt Caswell authored
A missing SSLfatal call can result in an assertion failed error if the condition gets triggered. Reviewed-by:
-
Antoine Salon authored
Signed-off-by:
Antoine Salon <asalon@vmware.com> Reviewed-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
Antoine Salon authored
Signed-off-by:
-
- Nov 14, 2018
-
-
Matt Caswell authored
Reviewed-by:
-
- Nov 13, 2018
-
-
Richard Levitte authored
Reviewed-by:
-
Richard Levitte authored
We therefore must add defaults. Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7626)
-
Richard Levitte authored
When libssl and libcrypto are compiled on Linux with "-rpath", but not "--enable-new-dtags", the RPATH takes precedence over LD_LIBRARY_PATH, and we end up running with the wrong libraries. This is resolved by using full (or at least relative, rather than just the filename to be found on LD_LIBRARY_PATH) paths to the shared objects. Reviewed-by:
-
Shane Lontis authored
Reviewed-by:
-
Richard Levitte authored
HTML comments aren't rendered, so markdown link syntax is irrelevant inside them, and more confusing than useful. Reviewed-by:
-
Richard Levitte authored
This will hopefully help directing our users to better user support resources as well as give some relevant advice in issue templates. https://help.github.com/articles/setting-up-your-project-for-healthy-contributions/ Reviewed-by:
-
- Nov 12, 2018
-
-
Viktor Dukhovni authored
SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: -
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
Matt Caswell authored
SSL(_CTX)?_set_client_CA_list() was a server side only function in 1.1.0. If it was called on the client side then it was ignored. In 1.1.1 it now makes sense to have a CA list defined for both client and server (the client now sends it the the TLSv1.3 certificate_authorities extension). Unfortunately some applications were using the same SSL_CTX for both clients and servers and this resulted in some client ClientHellos being excessively large due to the number of certificate authorities being sent. This commit seperates out the CA list updated by SSL(_CTX)?_set_client_CA_list() and the more generic SSL(_CTX)?_set0_CA_list(). This means that SSL(_CTX)?_set_client_CA_list() still has no effect on the client side. If both CA lists are set then SSL(_CTX)?_set_client_CA_list() takes priority. Fixes #7411 Reviewed-by:
-
Matt Caswell authored
Reviewed-by:
-
