Dr. Stephen Henson [Wed, 13 Jan 2010 19:08:45 +0000 (19:08 +0000)]
Fix version handling so it can cope with a major version >3.
Although it will be many years before TLS v2.0 or later appears old versions
of servers have a habit of hanging around for a considerable time so best
if we handle this properly now.
Dr. Stephen Henson [Wed, 13 Jan 2010 18:45:03 +0000 (18:45 +0000)]
Modify compression code so it avoids using ex_data free functions. This
stops applications that call CRYPTO_free_all_ex_data() prematurely leaking
memory.
Dr. Stephen Henson [Thu, 7 Jan 2010 19:09:32 +0000 (19:09 +0000)]
Simplify RI+SCSV logic:
1. Send SCSV is not renegotiating, never empty RI.
2. Send RI if renegotiating.
Andy Polyakov [Thu, 7 Jan 2010 11:22:25 +0000 (11:22 +0000)]
x86_64-xlate.pl: new gas requires sign extention in lea instruction
[from HEAD].
PR: 2094,2095
Andy Polyakov [Thu, 7 Jan 2010 11:04:49 +0000 (11:04 +0000)]
util/pl/VC-32.pl: bufferoverflowu.lib only when actually needed [from HEAD].
PR: 2086
Dr. Stephen Henson [Wed, 6 Jan 2010 18:02:07 +0000 (18:02 +0000)]
correct error codes
Dr. Stephen Henson [Wed, 6 Jan 2010 17:59:41 +0000 (17:59 +0000)]
Updates to conform with draft-ietf-tls-renegotiation-03.txt:
1. Add provisional SCSV value.
2. Don't send SCSV and RI at same time.
3. Fatal error is SCSV received when renegotiating.
Dr. Stephen Henson [Tue, 5 Jan 2010 17:50:12 +0000 (17:50 +0000)]
Typo
Dr. Stephen Henson [Tue, 5 Jan 2010 17:33:20 +0000 (17:33 +0000)]
PR: 2132
Submitted by: steve
Fix bundled pod2man.pl to handle alternative comment formats.
Dr. Stephen Henson [Sun, 27 Dec 2009 23:03:40 +0000 (23:03 +0000)]
Update RI to match latest spec.
MCSV is now called SCSV.
Don't send SCSV if renegotiating.
Also note if RI is empty in debug messages.
Dr. Stephen Henson [Fri, 25 Dec 2009 14:11:18 +0000 (14:11 +0000)]
Traditional Yuletide commit ;-)
Add Triple DES CFB1 and CFB8 to algorithm list and NID translation.
Bodo Möller [Tue, 22 Dec 2009 11:45:57 +0000 (11:45 +0000)]
Constify crypto/cast.
Bodo Möller [Tue, 22 Dec 2009 10:59:03 +0000 (10:59 +0000)]
Constify crypto/cast.
Dr. Stephen Henson [Thu, 17 Dec 2009 16:38:18 +0000 (16:38 +0000)]
Ooops, engage ENGINE initialisation code correctly in FIPS builds.
Dr. Stephen Henson [Thu, 17 Dec 2009 15:42:25 +0000 (15:42 +0000)]
Alert to use is now defined in spec: update code
Dr. Stephen Henson [Wed, 16 Dec 2009 20:34:20 +0000 (20:34 +0000)]
New option to enable/disable connection to unpatched servers
Dr. Stephen Henson [Mon, 14 Dec 2009 01:32:47 +0000 (01:32 +0000)]
add another missed case
Dr. Stephen Henson [Mon, 14 Dec 2009 01:28:51 +0000 (01:28 +0000)]
simplify RI error code and catch extra error case ignored before
Dr. Stephen Henson [Mon, 14 Dec 2009 01:09:01 +0000 (01:09 +0000)]
Allow initial connection (but no renegoriation) to servers which don't support
RI.
Ben Laurie [Sat, 12 Dec 2009 11:10:25 +0000 (11:10 +0000)]
Missing newline.
Dr. Stephen Henson [Fri, 11 Dec 2009 00:22:12 +0000 (00:22 +0000)]
Move SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION out of SSL_OP_ALL
Dr. Stephen Henson [Wed, 9 Dec 2009 18:17:21 +0000 (18:17 +0000)]
clarify docs
Dr. Stephen Henson [Wed, 9 Dec 2009 18:01:07 +0000 (18:01 +0000)]
Document option clearning functions.
Initial secure renegotiation documentation.
Dr. Stephen Henson [Wed, 9 Dec 2009 13:41:50 +0000 (13:41 +0000)]
PR: 2124
Submitted by: Jan Pechanec <Jan.Pechanec@Sun.COM>
Check for memory allocation failures.
Dr. Stephen Henson [Wed, 9 Dec 2009 13:15:01 +0000 (13:15 +0000)]
Add ctrls to clear options and mode.
Change RI ctrl so it doesn't clash.
Dr. Stephen Henson [Tue, 8 Dec 2009 19:05:49 +0000 (19:05 +0000)]
Send no_renegotiation alert as required by spec.
Dr. Stephen Henson [Tue, 8 Dec 2009 13:47:28 +0000 (13:47 +0000)]
Add ctrl and macro so we can determine if peer support secure renegotiation.
Fix SSL_CIPHER initialiser for mcsv
Dr. Stephen Henson [Tue, 8 Dec 2009 13:15:38 +0000 (13:15 +0000)]
Add support for magic cipher suite value (MCSV). Make secure renegotiation
work in SSLv3: initial handshake has no extensions but includes MCSV, if
server indicates RI support then renegotiation handshakes include RI.
NB: current MCSV value is bogus for testing only, will be updated when we
have an official value.
Change mismatch alerts to handshake_failure as required by spec.
Also have some debugging fprintfs so we can clearly see what is going on
if OPENSSL_RI_DEBUG is set.
Dr. Stephen Henson [Wed, 2 Dec 2009 15:27:19 +0000 (15:27 +0000)]
PR: 2111
Submitted by: Martin Olsson <molsson@opera.com>
Check for bn_wexpand errors in bn_mul.c
Dr. Stephen Henson [Wed, 2 Dec 2009 14:39:12 +0000 (14:39 +0000)]
Replace the broken SPKAC certification with the correct version.
Dr. Stephen Henson [Tue, 1 Dec 2009 17:40:46 +0000 (17:40 +0000)]
PR: 2115
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
Add Renegotiation extension to DTLS, fix DTLS ClientHello processing bug.
Dr. Stephen Henson [Tue, 1 Dec 2009 17:32:16 +0000 (17:32 +0000)]
PR: 1432
Submitted by: "Andrzej Chmielowiec" <achmielowiec@enigma.com.pl>, steve@openssl.org
Approved by: steve@openssl.org
Truncate hash if it is too large: as required by FIPS 186-3.
Dr. Stephen Henson [Sun, 29 Nov 2009 13:44:59 +0000 (13:44 +0000)]
typo
Bodo Möller [Thu, 26 Nov 2009 18:35:33 +0000 (18:35 +0000)]
(whitespace)
Bodo Möller [Thu, 26 Nov 2009 17:30:07 +0000 (17:30 +0000)]
The version numbering may change, again; so be careful about what we
announce in CHANGES.
Bodo Möller [Thu, 26 Nov 2009 17:28:27 +0000 (17:28 +0000)]
Remove attribution -- this wasn't my patch, I only edited and applied it.
Bodo Möller [Thu, 26 Nov 2009 17:25:38 +0000 (17:25 +0000)]
Remove obsolete information about a change for 0.9.7n.
(No further releases from the 0.9.7 branch are planned. Note that the
"deleted" change is also in 0.9.8f.)
Dr. Stephen Henson [Wed, 18 Nov 2009 15:08:49 +0000 (15:08 +0000)]
Servers can't end up talking SSLv2 with legacy renegotiation disabled
Dr. Stephen Henson [Wed, 18 Nov 2009 14:43:27 +0000 (14:43 +0000)]
Don't use SSLv2 compatible client hello if we don't tolerate legacy renegotiation
Dr. Stephen Henson [Wed, 18 Nov 2009 14:24:00 +0000 (14:24 +0000)]
Include a more meaningful error message when rejecting legacy renegotiation
Dr. Stephen Henson [Fri, 13 Nov 2009 14:14:46 +0000 (14:14 +0000)]
PR: 2094
Submitted by: Arkadiusz Miskiewicz <arekm@maven.pl>
Approved by: steve@openssl.org
Fix for out range of signed 32bit displacement error on newer binutils.
Dr. Stephen Henson [Fri, 13 Nov 2009 14:09:45 +0000 (14:09 +0000)]
PR: 2084
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Parallel build fix.
Dr. Stephen Henson [Fri, 13 Nov 2009 14:09:09 +0000 (14:09 +0000)]
PR: 2101
Submitted by: Doug Kaufman <dkaufman@rahul.net>
Approved by: steve@openssl.org
Fixes for tests in cms-test.pl
Richard Levitte [Thu, 12 Nov 2009 16:59:18 +0000 (16:59 +0000)]
Updated from 1.0.0-stable.
Dr. Stephen Henson [Tue, 10 Nov 2009 01:53:02 +0000 (01:53 +0000)]
PR: 1686
Submitted by: Hanno BÃ\83¶ck <hanno@hboeck.de>
Approved by: steve@openssl.org
Create engines dir if it doesn't already exist.
Dr. Stephen Henson [Tue, 10 Nov 2009 01:00:37 +0000 (01:00 +0000)]
PR: 2091
Submitted by: Martin Kaiser <lists@kaiser.cx>, Stephen Henson
Approved by: steve@openssl.org
If an OID has no short name or long name return the numerical representation.
Dr. Stephen Henson [Tue, 10 Nov 2009 00:46:57 +0000 (00:46 +0000)]
check new_der for NULL too
Dr. Stephen Henson [Tue, 10 Nov 2009 00:40:42 +0000 (00:40 +0000)]
PR: 2090
Submitted by: Martin Kaiser <lists@kaiser.cx>, Stephen Henson
Approved by: steve@openssl.org
Improve error checking in asn1_gen.c
Dr. Stephen Henson [Mon, 9 Nov 2009 18:21:57 +0000 (18:21 +0000)]
Fix wrong function codes and duplicate codes
Dr. Stephen Henson [Mon, 9 Nov 2009 14:14:26 +0000 (14:14 +0000)]
Remove BF_PTR2 from configuration: it doesn't improve performance any more and causes gcc warnings about arrays out of range
Dr. Stephen Henson [Sun, 8 Nov 2009 17:07:42 +0000 (17:07 +0000)]
use OPENSSL_assert() and not assert()
Ben Laurie [Sun, 8 Nov 2009 14:51:54 +0000 (14:51 +0000)]
First cut of renegotiation extension.
Dr. Stephen Henson [Sun, 8 Nov 2009 14:30:22 +0000 (14:30 +0000)]
Re-revert (re-insert?) temporary change that made renegotiation work again
and add a proper fix: specifically if it is a new session don't send the old
TLS ticket, send a zero length ticket to request a new session.
Ben Laurie [Sun, 8 Nov 2009 12:14:55 +0000 (12:14 +0000)]
Revert renegotiation-breaking change.
Ben Laurie [Thu, 5 Nov 2009 11:28:37 +0000 (11:28 +0000)]
Disable renegotiation.
Ben Laurie [Thu, 5 Nov 2009 10:18:11 +0000 (10:18 +0000)]
Fix compilation problem.
Dr. Stephen Henson [Wed, 4 Nov 2009 12:58:54 +0000 (12:58 +0000)]
PR: 2089
Submitted by: David Woodhouse <dwmw2@infradead.org>
Approved by: steve@openssl.org
Use EVP_MD_size() in OpenSSL 0.9.8.
Dr. Stephen Henson [Mon, 2 Nov 2009 13:36:56 +0000 (13:36 +0000)]
PR: 2089
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
DTLS Fragment size bug fix.
Dr. Stephen Henson [Fri, 30 Oct 2009 14:07:59 +0000 (14:07 +0000)]
Generate stateless session ID just after the ticket is received instead
of when a session is loaded. This will mean that applications that
just hold onto SSL_SESSION structures and never call d2i_SSL_SESSION()
will still work.
Dr. Stephen Henson [Fri, 30 Oct 2009 13:28:07 +0000 (13:28 +0000)]
Fix stateless session resumption so it can coexist with SNI
Dr. Stephen Henson [Wed, 28 Oct 2009 19:53:10 +0000 (19:53 +0000)]
Don't attempt session resumption if no ticket is present and session
ID length is zero.
Dr. Stephen Henson [Wed, 28 Oct 2009 19:29:05 +0000 (19:29 +0000)]
PR: 2085
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Change domd test to match 1.0.0+ version: check $MAKEDEPEND
ends in "gcc" to support cross compilers.
Dr. Stephen Henson [Wed, 28 Oct 2009 15:33:06 +0000 (15:33 +0000)]
Don't replace whole AR line
Dr. Stephen Henson [Wed, 28 Oct 2009 14:00:54 +0000 (14:00 +0000)]
PR: 2081
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Respect AR and RANLIB environment variables if set.
Dr. Stephen Henson [Wed, 28 Oct 2009 13:56:06 +0000 (13:56 +0000)]
PR: 2080
Submitted by: Mike Frysinger <vapier@gentoo.org>
Approved by: steve@openssl.org
Respect MAKE environment variable if set.
Dr. Stephen Henson [Wed, 28 Oct 2009 13:52:19 +0000 (13:52 +0000)]
PR: 2078
Submitted by: Dale Anderson <dra@redevised.net>
Approved by: steve@openssl.org
Corrections to bn_internal documentation.
Dr. Stephen Henson [Sun, 18 Oct 2009 14:24:47 +0000 (14:24 +0000)]
Pick up install prefix from the environment, if set.
Dr. Stephen Henson [Fri, 16 Oct 2009 15:29:07 +0000 (15:29 +0000)]
PR: 2074
Submitted by: Bram Neijt <bneijt@gmail.com>
Approved by: steve@openssl.org
Typo: "contet".
Dr. Stephen Henson [Fri, 16 Oct 2009 13:42:15 +0000 (13:42 +0000)]
PR: 2073
Submitted by: Tomas Mraz <tmraz@redhat.com>
Approved by: steve@openssl.org
Don't access freed SSL_CTX in SSL_free().
Dr. Stephen Henson [Thu, 15 Oct 2009 23:45:22 +0000 (23:45 +0000)]
CROSS_COMPILE: don't override command line option from environment
Dr. Stephen Henson [Thu, 15 Oct 2009 17:28:02 +0000 (17:28 +0000)]
PR: 1847
Submitted by: Tomas Mraz <tmraz@redhat.com>
Approved by: steve@openssl.org
Integrated patches to CA.sh to bring it into line with CA.pl functionality.
Dr. Stephen Henson [Thu, 15 Oct 2009 14:14:35 +0000 (14:14 +0000)]
Cross compilation updates.
Dr. Stephen Henson [Thu, 15 Oct 2009 13:02:42 +0000 (13:02 +0000)]
Backport cross compilation options from HEAD.
Dr. Stephen Henson [Thu, 15 Oct 2009 12:58:00 +0000 (12:58 +0000)]
Allow uname values to be overridden by the environment
Dr. Stephen Henson [Thu, 15 Oct 2009 12:30:21 +0000 (12:30 +0000)]
Quote filenames in case they contain spaces. Print out supported values
for --enable and --disable.
Dr. Stephen Henson [Mon, 5 Oct 2009 13:32:56 +0000 (13:32 +0000)]
Oops!
Dr. Stephen Henson [Sun, 4 Oct 2009 16:53:18 +0000 (16:53 +0000)]
Fix unitialized warnings
Dr. Stephen Henson [Sun, 4 Oct 2009 16:43:39 +0000 (16:43 +0000)]
Fix warnings about ignoring fgets return value
Dr. Stephen Henson [Sun, 4 Oct 2009 14:04:36 +0000 (14:04 +0000)]
Prevent ignored return value warning
Dr. Stephen Henson [Sun, 4 Oct 2009 14:02:35 +0000 (14:02 +0000)]
Prevent aliasing warning
Dr. Stephen Henson [Thu, 1 Oct 2009 00:22:23 +0000 (00:22 +0000)]
PR: 2062
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BN_rand error handling in bntest.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:18:09 +0000 (00:18 +0000)]
PR: 2059
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct EVP_SealInit error handling in pem_seal.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:12:49 +0000 (00:12 +0000)]
PR: 2056
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_wirte error handling in asn1_par.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:07:21 +0000 (00:07 +0000)]
PR: 2055
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_ctrl error handling in s2_srvr.c
Dr. Stephen Henson [Thu, 1 Oct 2009 00:03:59 +0000 (00:03 +0000)]
PR: 2054
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_ctrl error handling
Dr. Stephen Henson [Wed, 30 Sep 2009 23:59:42 +0000 (23:59 +0000)]
PR: 2063
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_write error handling in ocsp_prn.c
Dr. Stephen Henson [Wed, 30 Sep 2009 23:56:29 +0000 (23:56 +0000)]
PR: 2057
Submitted by: Julia Lawall <julia@diku.dk>
Approved by: steve@openssl.org
Correct BIO_write, BIO_printf, i2a_ASN1_INTEGER and i2a_ASN1_OBJECT
error handling in OCSP print routines.
Ben Laurie [Sun, 27 Sep 2009 14:04:33 +0000 (14:04 +0000)]
Make it build, plus make depend.
Dr. Stephen Henson [Tue, 22 Sep 2009 11:33:58 +0000 (11:33 +0000)]
PR: 2050
Submitted by: Michael Tuexen <tuexen@fh-muenster.de>
Approved by: steve@openssl.org
Fix handling of ENOTCONN and EMSGSIZE for dgram BIOs.
Dr. Stephen Henson [Tue, 22 Sep 2009 11:28:05 +0000 (11:28 +0000)]
Don't set non fips allow flags when calling RSA_new() and DSA_new().
Dr. Stephen Henson [Sun, 20 Sep 2009 13:26:46 +0000 (13:26 +0000)]
Stop unused variable warning.
Dr. Stephen Henson [Sun, 20 Sep 2009 12:53:42 +0000 (12:53 +0000)]
Typo presumably...
Dr. Stephen Henson [Sun, 20 Sep 2009 12:46:42 +0000 (12:46 +0000)]
Ooops, missing close quote
Dr. Stephen Henson [Sun, 20 Sep 2009 12:38:46 +0000 (12:38 +0000)]
Don't use __try+__except unless on VC++
Dr. Stephen Henson [Sun, 20 Sep 2009 11:40:24 +0000 (11:40 +0000)]
add version info for VC-WIN64I too
Dr. Stephen Henson [Sat, 19 Sep 2009 23:01:52 +0000 (23:01 +0000)]
PR: 2048
Submitted by: john blair <mailtome200420032002@yahoo.com>
Approved by: steve@openssl.org
Add version info in VC-WIN64A too.
Dr. Stephen Henson [Tue, 15 Sep 2009 23:11:22 +0000 (23:11 +0000)]
PR: 2039
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Approved by: steve@openssl.org
DTLS listen bug fix,
Dr. Stephen Henson [Sun, 13 Sep 2009 11:23:37 +0000 (11:23 +0000)]
Add CHANGES entry.
Dr. Stephen Henson [Sun, 13 Sep 2009 11:20:38 +0000 (11:20 +0000)]
Submitted by: Julia Lawall <julia@diku.dk>
The functions ENGINE_ctrl(), OPENSSL_isservice(),
CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error fix
so the return code is checked correctly.
Dr. Stephen Henson [Sat, 12 Sep 2009 23:34:19 +0000 (23:34 +0000)]
PR: 2023
Submitted by: James Beckett <jmb.openssl@nospam.hackery.net>, steve
Approved by: steve@openssl.org
Fix documentation errors in d2i_X509 manual pages.
projects / openssl.git / log