- Dec 13, 2015
-
-
Andy Polyakov authored
RT#4171 Reviewed-by: Kurt Roeckx <kurt@openssl.org> (cherry picked from commit b9749432)
-
- Dec 10, 2015
-
-
Andy Polyakov authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
A BIO_flush call in the DTLS code was not correctly setting the |rwstate| variable to SSL_WRITING. This means that SSL_get_error() will not return SSL_ERROR_WANT_WRITE in the event of an IO retry. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 67f60be8)
-
Matt Caswell authored
If using DTLS and NBIO then if a second or subsequent handshake message fragment hits a retry, then the retry attempt uses the wrong fragment offset value. This commit restores the fragment offset from the last attempt. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 2ad226e8)
-
Matt Caswell authored
If the call to OBJ_find_sigid_by_algs fails to find the relevant NID then we should set the NID to NID_undef. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 330dcb09)
-
- Dec 09, 2015
-
-
Dr Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org>
-
- Dec 08, 2015
-
-
Rich Salz authored
Reviewed-by: Steve Marquess <marquess@openssl.com> (cherry picked from commit ab29c82a)
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 3cd7aef3)
-
Richard Levitte authored
As part of this, move release creation to a script to be called from .travis.yml. That makes it much easier to test outside of travis. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 382af61f)
-
Richard Levitte authored
Introducing DISTTARVARS to propagate changed variables down to the tar-making target. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 4d3c30a1)
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
- Dec 07, 2015
-
-
Richard Levitte authored
It seems like some tar versions don't like the name:id form for --owner and --group. The closest known anonymous user being 0 (root), that seems to be the most appropriate user/group to assign ownership to. It matters very little when unpacking either way. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit b91dd150)
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 451a5bdf)
-
Richard Levitte authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 475fc3d8)
-
Richard Levitte authored
Make TARFILE include ../ instead of having that hard coded all over the place. When transforming file names in TAR_COMMAND, use $(NAME) instead of openssl-$(VERSION) Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 4a544810)
-
- Dec 03, 2015
-
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Update the CHANGES and NEWS files for the new release. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Dr. Stephen Henson authored
Avoid seg fault by checking mgf1 parameter is not NULL. This can be triggered during certificate verification so could be a DoS attack against a client or a server enabling client authentication. Thanks to Loïc Jonas Etienne (Qnective AG) for discovering this bug. CVE-2015-3194 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Andy Polyakov authored
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit e7c078db57908cbf16074c68034977565ffaf107)
-
Dr. Stephen Henson authored
When parsing a combined structure pass a flag to the decode routine so on error a pointer to the parent structure is not zeroed as this will leak any additional components in the parent. This can leak memory in any application parsing PKCS#7 or CMS structures. CVE-2015-3195. Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using libFuzzer. PR#4131 Reviewed-by: Richard Levitte <levitte@openssl.org>
-
Richard Levitte authored
Reviewed-by: Matt Caswell <matt@openssl.org>
-
Andy Polyakov authored
RT#4162 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit b5516cfb)
-
- Dec 02, 2015
-
-
Richard Levitte authored
The feature_test_macros(7) manual tells us that _BSD_SOURCE is deprecated since glibc 2.20 and that the compiler will warn about it being used, unless _DEFAULT_SOURCE is defined as well. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit f9fd3524)
-
Andy Polyakov authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 2238e0e4)
-
- Dec 01, 2015
-
-
Matt Caswell authored
In the DTLS ClientHello processing the return value is stored in |ret| which by default is -1. |ret| is only updated to a positive value once we are past all points where we could hit an error. We wish to return 1 on success or 2 on success *and* we have validated the DTLS cookie. Previously on successful validation of the cookie we were setting |ret| to -2, and then once we were past all error points we set |ret = -ret|. This is non-obvious behaviour and could be error prone. This commit tries to make this a bit more intuitive. Reviewed-by: Andy Polyakov <appro@openssl.org>
-
- Nov 30, 2015
-
-
Andy Polyakov authored
RT#4142 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 76eba0d9 ) Resolved conflicts: crypto/bn/asm/x86_64-mont.pl crypto/bn/asm/x86_64-mont5.pl Reviewed-by: Kurt Roeckx <kurt@openssl.org>
-
- Nov 24, 2015
-
-
Kurt Roeckx authored
Reviewed-by: Andy Polyakov <appro@openssl.org>
-
Marcus Meissner authored
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@akamai.com> GH: #466 (cherry picked from commit 434b5845)
-
Pascal Cuoq authored
If somewhere in SSL_new() there is a memory allocation failure, ssl3_free() can get called with s->s3 still being NULL. Patch also provided by Willy Tarreau <wtarreau@haproxy.com> Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org> (cherry picked from commit 3e7bd2ce0b16f8611298175d6dc7cb35ee06ea6d)
-
Kurt Roeckx authored
Backport of 0e04674e Reviewed-by: Steve Henson <steve@openssl.org> RT #4047, #4110, MR #1356
-
Dr. Stephen Henson authored
Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 63eb10a0)
-
Dr. Stephen Henson authored
Thanks to Guido Vranken <guidovranken@gmail.com> for reporting this issue. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 158e5207) Conflicts: crypto/asn1/asn1_par.c
-
- Nov 23, 2015
-
-
Andy Polyakov authored
RT#4138 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 193ed2d7)
-
- Nov 22, 2015
-
-
Kurt Roeckx authored
Strict ISO confirming C compilers only define __sun Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org> RT #4144, MR #1353 (cherry picked from commit 3d322188)
-
- Nov 21, 2015
-
-
Alessandro Ghedini authored
Original patch by Frank Morgner. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@akamai.com> GH: #456 (cherry picked from commit 68db80e2)
-
Viktor Dukhovni authored
Though the callers check the function return value and ignore the size_t output argument on failure, it is still often not ideal to store -1 in a size_t on error. That might signal an unduly large buffer. Instead set the size_t to 0, to indicate no space. Reviewed-by: Richard Levitte <levitte@openssl.org>
-
- Nov 20, 2015
-
-
Matt Caswell authored
There are lots of calls to EVP functions from within libssl There were various places where we should probably check the return value but don't. This adds these checks. Reviewed-by: Richard Levitte <levitte@openssl.org>
-