Dr. Stephen Henson [Tue, 8 Dec 2009 13:15:38 +0000 (13:15 +0000)]
Add support for magic cipher suite value (MCSV). Make secure renegotiation
work in SSLv3: initial handshake has no extensions but includes MCSV, if
server indicates RI support then renegotiation handshakes include RI.
NB: current MCSV value is bogus for testing only, will be updated when we
have an official value.
Change mismatch alerts to handshake_failure as required by spec.
Also have some debugging fprintfs so we can clearly see what is going on
if OPENSSL_RI_DEBUG is set.
Dr. Stephen Henson [Wed, 2 Dec 2009 15:27:19 +0000 (15:27 +0000)]
PR: 2111
Submitted by: Martin Olsson <molsson@opera.com>
Check for bn_wexpand errors in bn_mul.c
Dr. Stephen Henson [Wed, 2 Dec 2009 14:39:12 +0000 (14:39 +0000)]
Replace the broken SPKAC certification with the correct version.
Dr. Stephen Henson [Tue, 1 Dec 2009 17:40:46 +0000 (17:40 +0000)]
PR: 2115
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
Add Renegotiation extension to DTLS, fix DTLS ClientHello processing bug.
Dr. Stephen Henson [Tue, 1 Dec 2009 17:32:16 +0000 (17:32 +0000)]
PR: 1432
Submitted by: "Andrzej Chmielowiec" <achmielowiec@enigma.com.pl>, steve@openssl.org
Approved by: steve@openssl.org
Truncate hash if it is too large: as required by FIPS 186-3.
Dr. Stephen Henson [Sun, 29 Nov 2009 13:44:59 +0000 (13:44 +0000)]
typo
Bodo Möller [Thu, 26 Nov 2009 18:35:33 +0000 (18:35 +0000)]
(whitespace)
Bodo Möller [Thu, 26 Nov 2009 17:30:07 +0000 (17:30 +0000)]
The version numbering may change, again; so be careful about what we
announce in CHANGES.
Bodo Möller [Thu, 26 Nov 2009 17:28:27 +0000 (17:28 +0000)]
Remove attribution -- this wasn't my patch, I only edited and applied it.
Bodo Möller [Thu, 26 Nov 2009 17:25:38 +0000 (17:25 +0000)]
Remove obsolete information about a change for 0.9.7n.
(No further releases from the 0.9.7 branch are planned. Note that the
"deleted" change is also in 0.9.8f.)
Dr. Stephen Henson [Wed, 18 Nov 2009 15:08:49 +0000 (15:08 +0000)]
Servers can't end up talking SSLv2 with legacy renegotiation disabled
Dr. Stephen Henson [Wed, 18 Nov 2009 14:43:27 +0000 (14:43 +0000)]
Don't use SSLv2 compatible client hello if we don't tolerate legacy renegotiation
Dr. Stephen Henson [Wed, 18 Nov 2009 14:24:00 +0000 (14:24 +0000)]
Include a more meaningful error message when rejecting legacy renegotiation
Dr. Stephen Henson [Fri, 13 Nov 2009 14:14:46 +0000 (14:14 +0000)]
PR: 2094
Submitted by: Arkadiusz Miskiewicz <arekm@maven.pl>
Approved by: steve@openssl.org
Fix for out range of signed 32bit displacement error on newer binutils.
Dr. Stephen Henson [Fri, 13 Nov 2009 14:09:45 +0000 (14:09 +0000)]
PR: 2084
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Parallel build fix.
Dr. Stephen Henson [Fri, 13 Nov 2009 14:09:09 +0000 (14:09 +0000)]
PR: 2101
Submitted by: Doug Kaufman <dkaufman@rahul.net>
Approved by: steve@openssl.org
Fixes for tests in cms-test.pl
Richard Levitte [Thu, 12 Nov 2009 16:59:18 +0000 (16:59 +0000)]
Updated from 1.0.0-stable.
Dr. Stephen Henson [Tue, 10 Nov 2009 01:53:02 +0000 (01:53 +0000)]
PR: 1686
Submitted by: Hanno BÃ\83¶ck <hanno@hboeck.de>
Approved by: steve@openssl.org
Create engines dir if it doesn't already exist.
Dr. Stephen Henson [Tue, 10 Nov 2009 01:00:37 +0000 (01:00 +0000)]
PR: 2091
Submitted by: Martin Kaiser <lists@kaiser.cx>, Stephen Henson
Approved by: steve@openssl.org
If an OID has no short name or long name return the numerical representation.
Dr. Stephen Henson [Tue, 10 Nov 2009 00:46:57 +0000 (00:46 +0000)]
check new_der for NULL too
Dr. Stephen Henson [Tue, 10 Nov 2009 00:40:42 +0000 (00:40 +0000)]
PR: 2090
Submitted by: Martin Kaiser <lists@kaiser.cx>, Stephen Henson
Approved by: steve@openssl.org
Improve error checking in asn1_gen.c
Dr. Stephen Henson [Mon, 9 Nov 2009 18:21:57 +0000 (18:21 +0000)]
Fix wrong function codes and duplicate codes
Dr. Stephen Henson [Mon, 9 Nov 2009 14:14:26 +0000 (14:14 +0000)]
Remove BF_PTR2 from configuration: it doesn't improve performance any more and causes gcc warnings about arrays out of range
Dr. Stephen Henson [Sun, 8 Nov 2009 17:07:42 +0000 (17:07 +0000)]
use OPENSSL_assert() and not assert()
Ben Laurie [Sun, 8 Nov 2009 14:51:54 +0000 (14:51 +0000)]
First cut of renegotiation extension.
Dr. Stephen Henson [Sun, 8 Nov 2009 14:30:22 +0000 (14:30 +0000)]
Re-revert (re-insert?) temporary change that made renegotiation work again
and add a proper fix: specifically if it is a new session don't send the old
TLS ticket, send a zero length ticket to request a new session.
Ben Laurie [Sun, 8 Nov 2009 12:14:55 +0000 (12:14 +0000)]
Revert renegotiation-breaking change.
Ben Laurie [Thu, 5 Nov 2009 11:28:37 +0000 (11:28 +0000)]
Disable renegotiation.
Ben Laurie [Thu, 5 Nov 2009 10:18:11 +0000 (10:18 +0000)]
Fix compilation problem.
Dr. Stephen Henson [Wed, 4 Nov 2009 12:58:54 +0000 (12:58 +0000)]
PR: 2089
Submitted by: David Woodhouse <dwmw2@infradead.org>
Approved by: steve@openssl.org
Use EVP_MD_size() in OpenSSL 0.9.8.
Dr. Stephen Henson [Mon, 2 Nov 2009 13:36:56 +0000 (13:36 +0000)]
PR: 2089
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
DTLS Fragment size bug fix.
Dr. Stephen Henson [Fri, 30 Oct 2009 14:07:59 +0000 (14:07 +0000)]
Generate stateless session ID just after the ticket is received instead
of when a session is loaded. This will mean that applications that
just hold onto SSL_SESSION structures and never call d2i_SSL_SESSION()
will still work.
Dr. Stephen Henson [Fri, 30 Oct 2009 13:28:07 +0000 (13:28 +0000)]
Fix stateless session resumption so it can coexist with SNI
Dr. Stephen Henson [Wed, 28 Oct 2009 19:53:10 +0000 (19:53 +0000)]
Don't attempt session resumption if no ticket is present and session
ID length is zero.
Dr. Stephen Henson [Wed, 28 Oct 2009 19:29:05 +0000 (19:29 +0000)]
PR: 2085
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Change domd test to match 1.0.0+ version: check $MAKEDEPEND
ends in "gcc" to support cross compilers.
Dr. Stephen Henson [Wed, 28 Oct 2009 15:33:06 +0000 (15:33 +0000)]
Don't replace whole AR line
Dr. Stephen Henson [Wed, 28 Oct 2009 14:00:54 +0000 (14:00 +0000)]
PR: 2081
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Respect AR and RANLIB environment variables if set.
Dr. Stephen Henson [Wed, 28 Oct 2009 13:56:06 +0000 (13:56 +0000)]
PR: 2080
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Respect MAKE environment variable if set.
Dr. Stephen Henson [Wed, 28 Oct 2009 13:52:19 +0000 (13:52 +0000)]
PR: 2078
Submitted by: Dale Anderson <dra@redevised.net>
Approved by: steve@openssl.org
Corrections to bn_internal documentation.
Dr. Stephen Henson [Sun, 18 Oct 2009 14:24:47 +0000 (14:24 +0000)]
Pick up install prefix from the environment, if set.
Dr. Stephen Henson [Fri, 16 Oct 2009 15:29:07 +0000 (15:29 +0000)]
PR: 2074
Submitted by: Bram Neijt <bneijt@gmail.com>
Approved by: steve@openssl.org
Typo: "contet".
Dr. Stephen Henson [Fri, 16 Oct 2009 13:42:15 +0000 (13:42 +0000)]
PR: 2073
Submitted by: Tomas Mraz <tmraz@redhat.com>
Approved by: steve@openssl.org
Don't access freed SSL_CTX in SSL_free().
Dr. Stephen Henson [Thu, 15 Oct 2009 23:45:22 +0000 (23:45 +0000)]
CROSS_COMPILE: don't override command line option from environment
Dr. Stephen Henson [Thu, 15 Oct 2009 17:28:02 +0000 (17:28 +0000)]
PR: 1847
Submitted by: Tomas Mraz <tmraz@redhat.com>
Approved by: steve@openssl.org
Integrated patches to CA.sh to bring it into line with CA.pl functionality.
Dr. Stephen Henson [Thu, 15 Oct 2009 14:14:35 +0000 (14:14 +0000)]
Cross compilation updates.
Dr. Stephen Henson [Thu, 15 Oct 2009 13:02:42 +0000 (13:02 +0000)]
Backport cross compilation options from HEAD.
Dr. Stephen Henson [Thu, 15 Oct 2009 12:58:00 +0000 (12:58 +0000)]
Allow uname values to be overridden by the environment
Dr. Stephen Henson [Thu, 15 Oct 2009 12:30:21 +0000 (12:30 +0000)]
Quote filenames in case they contain spaces. Print out supported values
for --enable and --disable.
Dr. Stephen Henson [Mon, 5 Oct 2009 13:32:56 +0000 (13:32 +0000)]
Oops!
Dr. Stephen Henson [Sun, 4 Oct 2009 16:53:18 +0000 (16:53 +0000)]
Fix unitialized warnings
Dr. Stephen Henson [Sun, 4 Oct 2009 16:43:39 +0000 (16:43 +0000)]
Fix warnings about ignoring fgets return value
Dr. Stephen Henson [Sun, 4 Oct 2009 14:04:36 +0000 (14:04 +0000)]
Prevent ignored return value warning
Dr. Stephen Henson [Sun, 4 Oct 2009 14:02:35 +0000 (14:02 +0000)]
Prevent aliasing warning
Dr. Stephen Henson [Thu, 1 Oct 2009 00:22:23 +0000 (00:22 +0000)]
PR: 2062
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BN_rand error handling in bntest.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:18:09 +0000 (00:18 +0000)]
PR: 2059
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct EVP_SealInit error handling in pem_seal.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:12:49 +0000 (00:12 +0000)]
PR: 2056
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_wirte error handling in asn1_par.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:07:21 +0000 (00:07 +0000)]
PR: 2055
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_ctrl error handling in s2_srvr.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:03:59 +0000 (00:03 +0000)]
PR: 2054
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_ctrl error handling
Dr. Stephen Henson [Wed, 30 Sep 2009 23:59:42 +0000 (23:59 +0000)]
PR: 2063
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_write error handling in ocsp_prn.c
Dr. Stephen Henson [Wed, 30 Sep 2009 23:56:29 +0000 (23:56 +0000)]
PR: 2057
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_write, BIO_printf, i2a_ASN1_INTEGER and i2a_ASN1_OBJECT
error handling in OCSP print routines.
Ben Laurie [Sun, 27 Sep 2009 14:04:33 +0000 (14:04 +0000)]
Make it build, plus make depend.
Dr. Stephen Henson [Tue, 22 Sep 2009 11:33:58 +0000 (11:33 +0000)]
PR: 2050
Submitted by: Michael Tuexen <tuexen@fh-muenster.de>
Approved by: steve@openssl.org
Fix handling of ENOTCONN and EMSGSIZE for dgram BIOs.
Dr. Stephen Henson [Tue, 22 Sep 2009 11:28:05 +0000 (11:28 +0000)]
Don't set non fips allow flags when calling RSA_new() and DSA_new().
Dr. Stephen Henson [Sun, 20 Sep 2009 13:26:46 +0000 (13:26 +0000)]
Stop unused variable warning.
Dr. Stephen Henson [Sun, 20 Sep 2009 12:53:42 +0000 (12:53 +0000)]
Typo presumably...
Dr. Stephen Henson [Sun, 20 Sep 2009 12:46:42 +0000 (12:46 +0000)]
Ooops, missing close quote
Dr. Stephen Henson [Sun, 20 Sep 2009 12:38:46 +0000 (12:38 +0000)]
Don't use __try+__except unless on VC++
Dr. Stephen Henson [Sun, 20 Sep 2009 11:40:24 +0000 (11:40 +0000)]
add version info for VC-WIN64I too
Dr. Stephen Henson [Sat, 19 Sep 2009 23:01:52 +0000 (23:01 +0000)]
PR: 2048
Submitted by: john blair <mailtome200420032002@yahoo.com>
Approved by: steve@openssl.org
Add version info in VC-WIN64A too.
Dr. Stephen Henson [Tue, 15 Sep 2009 23:11:22 +0000 (23:11 +0000)]
PR: 2039
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
DTLS listen bug fix,
Dr. Stephen Henson [Sun, 13 Sep 2009 11:23:37 +0000 (11:23 +0000)]
Add CHANGES entry.
Dr. Stephen Henson [Sun, 13 Sep 2009 11:20:38 +0000 (11:20 +0000)]
Submitted by: Julia Lawall <julia@diku.dk>
The functions ENGINE_ctrl(), OPENSSL_isservice(),
CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error fix
so the return code is checked correctly.
Dr. Stephen Henson [Sat, 12 Sep 2009 23:34:19 +0000 (23:34 +0000)]
PR: 2023
Submitted by: James Beckett <jmb.openssl@nospam.hackery.net>, steve
Approved by: steve@openssl.org
Fix documentation errors in d2i_X509 manual pages.
Dr. Stephen Henson [Sat, 12 Sep 2009 23:18:43 +0000 (23:18 +0000)]
PR: 2025
Submitted by: Tomas Mraz <tmraz@redhat.com>
Approved by: steve@openssl.org
Constify SSL_CIPHER_description
Dr. Stephen Henson [Sat, 12 Sep 2009 23:09:59 +0000 (23:09 +0000)]
PR: 1411
Submitted by: steve@openssl.org
Allow use of trusted certificates in SSL_CTX_use_chain_file()
Dr. Stephen Henson [Wed, 9 Sep 2009 17:06:13 +0000 (17:06 +0000)]
PR: 2033
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
DTLS listen support.
Dr. Stephen Henson [Wed, 9 Sep 2009 16:30:49 +0000 (16:30 +0000)]
Add new option --strict-warnings to Configure script. This is used to add
in devteam warnings into other configurations.
Dr. Stephen Henson [Wed, 9 Sep 2009 12:07:41 +0000 (12:07 +0000)]
Seed PRNG with DSA and ECDSA digests for additional protection against
possible PRNG state duplication.
Dr. Stephen Henson [Sun, 6 Sep 2009 16:14:20 +0000 (16:14 +0000)]
make update
Dr. Stephen Henson [Sun, 6 Sep 2009 15:46:46 +0000 (15:46 +0000)]
PR: 1644
Submitted by: steve@openssl.org
Fix to make DHparams_dup() et al work in C++.
For 0.9.8, we just change the macro to avoid making incompatible changes to
the API.
Dr. Stephen Henson [Fri, 4 Sep 2009 17:53:30 +0000 (17:53 +0000)]
PR: 2028
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
Fix DTLS cookie management bugs.
Dr. Stephen Henson [Fri, 4 Sep 2009 16:42:17 +0000 (16:42 +0000)]
PR: 2022
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
Fix DTLS record header length bug.
Dr. Stephen Henson [Fri, 4 Sep 2009 12:26:47 +0000 (12:26 +0000)]
Correction: salt is now default
Dr. Stephen Henson [Wed, 2 Sep 2009 13:20:02 +0000 (13:20 +0000)]
PR: 2009
Submitted by: "Alexei Khlebnikov" <alexei.khlebnikov@opera.com>
Approved by: steve@openssl.org
Avoid memory leak and fix error reporting in d2i_SSL_SESSION(). NB: although
the ticket mentions buffer overruns this isn't a security issue because
the SSL_SESSION structure is generated internally and it should never be
possible to supply its contents from an untrusted application (this would
among other things destroy session cache security).
Dr. Stephen Henson [Wed, 26 Aug 2009 11:54:14 +0000 (11:54 +0000)]
PR: 2006
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
Do not use multiple DTLS records for a single user message
Dr. Stephen Henson [Wed, 26 Aug 2009 11:45:58 +0000 (11:45 +0000)]
Oops.
Dr. Stephen Henson [Wed, 26 Aug 2009 11:44:18 +0000 (11:44 +0000)]
PR: 2015
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
Define LIBDIR properly.
Richard Levitte [Wed, 26 Aug 2009 11:21:57 +0000 (11:21 +0000)]
Moving up the inclusion of e_os.h was a bad idea.
Put it back where it was and place an inclusion of e_os2.h to get platform
macros defined...
Richard Levitte [Tue, 25 Aug 2009 07:30:10 +0000 (07:30 +0000)]
Make sure ENGINES can be separately compiled as well.
Make sure _XOPEN_SOURCE_EXTENDED is defined in opensslconf.h
Submitted by Zoltan Arpadffy <zoli@polarhome.com>
Richard Levitte [Tue, 25 Aug 2009 07:28:18 +0000 (07:28 +0000)]
Remove tmdiff.h from EXHEADERS as it doesn't exist.
Don't have separate installation directory variables for VAX and AXP.
Submitted by Zoltan Arpadffy <zoli@polarhome.com>
Richard Levitte [Tue, 25 Aug 2009 07:26:25 +0000 (07:26 +0000)]
Add CMS to the list of applications.
Define EXE_DIR earlier.
Make sure S_SOCKET also gets compiled with _POSIX_C_SOURCE defined.
Submitted by Zoltan Arpadffy <zoli@polarhome.com>
Richard Levitte [Tue, 25 Aug 2009 07:24:00 +0000 (07:24 +0000)]
Move up the inclusion of e_os.h so OPENSSL_SYS_VMS_DECC has a chance
to be properly defined.
Richard Levitte [Tue, 25 Aug 2009 07:22:07 +0000 (07:22 +0000)]
Make it possible to compile non-assembler routines on AXP as well.
Submitted by Zoltan Arpadffy <arpadffy@polarhome.com>
Richard Levitte [Tue, 25 Aug 2009 07:19:25 +0000 (07:19 +0000)]
Make engines compile on VMS for ia64 as well.
Parse file types in a more secure manner.
Submitted by sms@antinode.info (Steven M. Schweda)
Richard Levitte [Tue, 25 Aug 2009 07:19:21 +0000 (07:19 +0000)]
file ia64.opt was added on branch OpenSSL_0_9_8-stable on 2009-08-25 07:19:25 +0000
Richard Levitte [Tue, 25 Aug 2009 07:19:19 +0000 (07:19 +0000)]
file alpha.opt was added on branch OpenSSL_0_9_8-stable on 2009-08-25 07:19:24 +0000
Richard Levitte [Tue, 25 Aug 2009 07:17:12 +0000 (07:17 +0000)]
Correct some typos and missing things.
Submitted by Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se>
Richard Levitte [Tue, 25 Aug 2009 07:10:40 +0000 (07:10 +0000)]
Include proper header files for time functions.
Submitted by Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se>
Dr. Stephen Henson [Sat, 15 Aug 2009 10:50:28 +0000 (10:50 +0000)]
Use SHA1 and not deprecated MD5 in demos.
Dr. Stephen Henson [Thu, 13 Aug 2009 15:14:32 +0000 (15:14 +0000)]
PR: 1997
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
DTLS timeout handling fix.
projects / openssl.git / log