Ben Laurie [Sat, 12 Jan 2013 12:25:30 +0000 (12:25 +0000)]
Correct EVP_PKEY_verifyrecover to EVP_PKEY_verify_recover (RT 2955).
Dr. Stephen Henson [Sun, 13 Jan 2013 22:57:22 +0000 (22:57 +0000)]
Add .gitignore
Dr. Stephen Henson [Sun, 30 Dec 2012 16:05:24 +0000 (16:05 +0000)]
make no-comp compile
Dr. Stephen Henson [Sun, 23 Dec 2012 18:19:47 +0000 (18:19 +0000)]
add missing \n
Dr. Stephen Henson [Mon, 10 Dec 2012 16:45:19 +0000 (16:45 +0000)]
PR: 2888
Reported by: Daniel Black <daniel.black@openquery.com>
Support renewing session tickets (backport from HEAD).
Dr. Stephen Henson [Thu, 6 Dec 2012 18:25:18 +0000 (18:25 +0000)]
Fix two bugs which affect delta CRL handling:
Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.
Dr. Stephen Henson [Tue, 4 Dec 2012 17:26:26 +0000 (17:26 +0000)]
check mval for NULL too
Dr. Stephen Henson [Mon, 3 Dec 2012 16:33:35 +0000 (16:33 +0000)]
fix leak
Dr. Stephen Henson [Thu, 29 Nov 2012 19:15:52 +0000 (19:15 +0000)]
PR: 2803
Submitted by: jean-etienne.schwartz@bull.net
In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.
Dr. Stephen Henson [Thu, 22 Nov 2012 14:15:00 +0000 (14:15 +0000)]
reject zero length point format list or supported curves extensions
Dr. Stephen Henson [Wed, 21 Nov 2012 14:01:55 +0000 (14:01 +0000)]
PR: 2908
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>
Fix DH double free if parameter generation fails.
Dr. Stephen Henson [Tue, 20 Nov 2012 00:29:09 +0000 (00:29 +0000)]
fix leaks
Dr. Stephen Henson [Mon, 19 Nov 2012 20:07:14 +0000 (20:07 +0000)]
correct docs
Dr. Stephen Henson [Sun, 18 Nov 2012 15:20:49 +0000 (15:20 +0000)]
PR: 2880
Submitted by: "Florian Rüchel" <florian.ruechel@ruhr-uni-bochum.de>
Correctly handle local machine keys in the capi ENGINE.
Andy Polyakov [Tue, 16 Oct 2012 08:20:18 +0000 (08:20 +0000)]
aix[64]-cc: get MT support right [from HEAD].
PR: 2896
Bodo Möller [Fri, 5 Oct 2012 20:51:31 +0000 (20:51 +0000)]
Fix EC_KEY initialization race.
Submitted by: Adam Langley
Dr. Stephen Henson [Fri, 5 Oct 2012 13:00:18 +0000 (13:00 +0000)]
backport OCSP fix enhancement
Ben Laurie [Thu, 4 Oct 2012 15:16:12 +0000 (15:16 +0000)]
Backport OCSP Stapling fix.
Ben Laurie [Thu, 4 Oct 2012 15:04:26 +0000 (15:04 +0000)]
Fix warning.
Ben Laurie [Thu, 4 Oct 2012 15:03:08 +0000 (15:03 +0000)]
Fix warning (hope this doesn't break other platforms, there's a twisty
little maze of #ifs, all different).
Bodo Möller [Mon, 24 Sep 2012 19:50:00 +0000 (19:50 +0000)]
Fix Valgrind warning.
Submitted by: Adam Langley
Richard Levitte [Mon, 24 Sep 2012 18:49:01 +0000 (18:49 +0000)]
* Configure: make the debug-levitte-linux{elf,noasm} less extreme.
Richard Levitte [Fri, 21 Sep 2012 13:08:26 +0000 (13:08 +0000)]
* ssl/t1_enc.c (tls1_change_cipher_state): Stupid bug. Fortunately in
debugging code that's seldom used.
Bodo Möller [Mon, 17 Sep 2012 17:26:03 +0000 (17:26 +0000)]
Fix warning.
Submitted by: Chromium Authors
Dr. Stephen Henson [Tue, 11 Sep 2012 13:45:11 +0000 (13:45 +0000)]
fix memory leak
Dr. Stephen Henson [Sat, 1 Sep 2012 11:30:19 +0000 (11:30 +0000)]
Don't load GOST ENGINE if it is already loaded.
Multiple copies of the ENGINE will cause problems when it is cleaned up as
the methods are stored in static structures which will be overwritten and
freed up more than once.
Set static methods to NULL when the ENGINE is freed so it can be reloaded.
Andy Polyakov [Fri, 17 Aug 2012 20:01:47 +0000 (20:01 +0000)]
sha1-armv4-large.pl: comply with ABI [from HEAD].
Andy Polyakov [Mon, 13 Aug 2012 16:39:42 +0000 (16:39 +0000)]
gosthash.c: use memmove in circle_xor8, as input pointers can be equal
[from HEAD].
PR: 2858
Andy Polyakov [Mon, 13 Aug 2012 16:21:00 +0000 (16:21 +0000)]
./Configure: libcrypto.a can grow to many GB on Solaris 10, because of ar bug
[from HEAD].
PR: 2838
Richard Levitte [Thu, 5 Jul 2012 08:49:02 +0000 (08:49 +0000)]
Cosmetics: remove duplicate symbol in crypto/symhacks.h
Richard Levitte [Wed, 4 Jul 2012 17:27:43 +0000 (17:27 +0000)]
Cosmetic: Reorder so it's more similar to the Unixly build.
Andy Polyakov [Sun, 1 Jul 2012 09:12:23 +0000 (09:12 +0000)]
bss_dgram.c: fix typos in Windows code.
Andy Polyakov [Wed, 27 Jun 2012 13:04:17 +0000 (13:04 +0000)]
x86_64 assembly pack: make it possible to compile with Perl located
on path with spaces [from HEAD].
PR: 2835
Dr. Stephen Henson [Tue, 19 Jun 2012 13:38:47 +0000 (13:38 +0000)]
oops, add -debug_decrypt option which was accidenatally left out
Andy Polyakov [Tue, 19 Jun 2012 12:50:09 +0000 (12:50 +0000)]
bss_dgram.c: fix bugs [from HEAD].
PR: 2833
Andy Polyakov [Wed, 16 May 2012 18:22:39 +0000 (18:22 +0000)]
s2_clnt.c: compensate for compiler bug [from HEAD].
Dr. Stephen Henson [Fri, 11 May 2012 13:50:09 +0000 (13:50 +0000)]
PR: 2813
Reported by: Constantine Sapuntzakis <csapuntz@gmail.com>
Fix possible deadlock when decoding public keys.
Dr. Stephen Henson [Thu, 10 May 2012 16:01:57 +0000 (16:01 +0000)]
prepare for next version
Dr. Stephen Henson [Thu, 10 May 2012 14:48:54 +0000 (14:48 +0000)]
prepare for 1.0.0j release
Dr. Stephen Henson [Thu, 10 May 2012 14:45:05 +0000 (14:45 +0000)]
update NEWS
Dr. Stephen Henson [Thu, 10 May 2012 14:44:20 +0000 (14:44 +0000)]
Sanity check record length before skipping explicit IV in DTLS
to fix DoS attack.
Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
fuzzing as a service testing platform.
(CVE-2012-2333)
Dr. Stephen Henson [Thu, 10 May 2012 13:28:28 +0000 (13:28 +0000)]
Reported by: Solar Designer of Openwall
Make sure tkeylen is initialised properly when encrypting CMS messages.
Richard Levitte [Fri, 4 May 2012 10:43:19 +0000 (10:43 +0000)]
Correct environment variable is OPENSSL_ALLOW_PROXY_CERTS.
Andy Polyakov [Fri, 27 Apr 2012 20:21:26 +0000 (20:21 +0000)]
ppccpuid.pl: branch hints in OPENSSL_cleanse impact small block performance
of digest algorithms, mosty SHA, on Power7. Mystery of century, why SHA,
why slower algorithm are affected more... [from HEAD].
PR: 2794
Submitted by: Ashley Lai
Dr. Stephen Henson [Sun, 22 Apr 2012 13:31:37 +0000 (13:31 +0000)]
correct error code
Dr. Stephen Henson [Sun, 22 Apr 2012 13:21:59 +0000 (13:21 +0000)]
correct old FAQ answers, sync with HEAD
Dr. Stephen Henson [Thu, 19 Apr 2012 17:02:49 +0000 (17:02 +0000)]
prepare for next version
Dr. Stephen Henson [Thu, 19 Apr 2012 11:47:20 +0000 (11:47 +0000)]
prepare for 1.0.0i release
Dr. Stephen Henson [Thu, 19 Apr 2012 11:45:37 +0000 (11:45 +0000)]
update NEWS
Dr. Stephen Henson [Thu, 19 Apr 2012 11:44:51 +0000 (11:44 +0000)]
Check for potentially exploitable overflows in asn1_d2i_read_bio
BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
in CRYPTO_realloc_clean.
Thanks to Tavis Ormandy, Google Security Team, for discovering this
issue and to Adam Langley <agl@chromium.org> for fixing it. (CVE-2012-2110)
Andy Polyakov [Thu, 19 Apr 2012 06:40:47 +0000 (06:40 +0000)]
Makefile.org: clear yet another environment variable [from HEAD].
PR: 2793
Andy Polyakov [Mon, 16 Apr 2012 17:43:28 +0000 (17:43 +0000)]
OPENSSL_NO_SOCK fixes [from HEAD].
PR: 2791
Submitted by: Ben Noordhuis
Andy Polyakov [Mon, 16 Apr 2012 17:37:04 +0000 (17:37 +0000)]
Minor compatibility fixes [from HEAD].
PR: 2790
Submitted by: Alexei Khlebnikov
Andy Polyakov [Sun, 15 Apr 2012 17:23:23 +0000 (17:23 +0000)]
s3_srvr.c: fix typo [from HEAD].
PR: 2538
Dr. Stephen Henson [Tue, 10 Apr 2012 22:28:34 +0000 (22:28 +0000)]
update rather ancient EVP digest documentation
Dr. Stephen Henson [Sat, 31 Mar 2012 18:02:35 +0000 (18:02 +0000)]
PR: 2778(part)
Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com>
Time is always encoded as 4 bytes, not sizeof(Time).
Andy Polyakov [Thu, 29 Mar 2012 17:51:37 +0000 (17:51 +0000)]
ans1/tasn_prn.c: avoid bool in variable names [from HEAD].
PR: 2776
Dr. Stephen Henson [Thu, 22 Mar 2012 15:43:06 +0000 (15:43 +0000)]
Submitted by: Markus Friedl <mfriedl@gmail.com>
Fix memory leaks in 'goto err' cases.
Dr. Stephen Henson [Sun, 18 Mar 2012 18:14:46 +0000 (18:14 +0000)]
Always use SSLv23_{client,server}_method in s_client.c and s_server.c,
the old code came from SSLeay days before TLS was even supported.
Richard Levitte [Wed, 14 Mar 2012 12:38:55 +0000 (12:38 +0000)]
cipher should only be set to PSK if JPAKE is used.
Andy Polyakov [Tue, 13 Mar 2012 19:22:26 +0000 (19:22 +0000)]
config: compensate for bug in Solaris cc drivers, which can remove /dev/null
[from HEAD,1.0.1]
Andy Polyakov [Tue, 13 Mar 2012 19:19:57 +0000 (19:19 +0000)]
x86_64-xlate.pl: remove old kludge.
PR: 2435,2440
Dr. Stephen Henson [Mon, 12 Mar 2012 16:35:49 +0000 (16:35 +0000)]
prepare for next version
Dr. Stephen Henson [Mon, 12 Mar 2012 15:26:48 +0000 (15:26 +0000)]
corrected fix to PR#2711 and also cover mime_param_cmp
Dr. Stephen Henson [Mon, 12 Mar 2012 14:45:07 +0000 (14:45 +0000)]
correct NEWS
Dr. Stephen Henson [Mon, 12 Mar 2012 14:32:54 +0000 (14:32 +0000)]
fix error code
Dr. Stephen Henson [Mon, 12 Mar 2012 14:24:50 +0000 (14:24 +0000)]
prepare for release
Dr. Stephen Henson [Mon, 12 Mar 2012 14:23:35 +0000 (14:23 +0000)]
update NEWS
Dr. Stephen Henson [Mon, 12 Mar 2012 14:22:59 +0000 (14:22 +0000)]
Fix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and
continue with symmetric decryption process to avoid leaking timing
information to an attacker.
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
this issue. (CVE-2012-0884)
Dr. Stephen Henson [Fri, 9 Mar 2012 15:52:09 +0000 (15:52 +0000)]
PR: 2756
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Fix DTLS timeout handling.
Dr. Stephen Henson [Thu, 8 Mar 2012 14:02:00 +0000 (14:02 +0000)]
check return value of BIO_write in PKCS7_decrypt
Dr. Stephen Henson [Tue, 6 Mar 2012 13:46:52 +0000 (13:46 +0000)]
PR: 2755
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Reduce MTU after failed transmissions.
Dr. Stephen Henson [Tue, 6 Mar 2012 13:22:57 +0000 (13:22 +0000)]
PR: 2748
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Fix possible DTLS timer deadlock.
Andy Polyakov [Sat, 3 Mar 2012 13:48:21 +0000 (13:48 +0000)]
Configure: make no-whirlpool work [from HEAD].
Dr. Stephen Henson [Wed, 29 Feb 2012 14:12:37 +0000 (14:12 +0000)]
PR: 2743
Reported by: Dmitry Belyavsky <beldmit@gmail.com>
Fix memory leak if invalid GOST MAC key given.
Dr. Stephen Henson [Wed, 29 Feb 2012 14:01:40 +0000 (14:01 +0000)]
PR: 2742
Reported by: Dmitry Belyavsky <beldmit@gmail.com>
If resigning with detached content in CMS just copy data across.
Dr. Stephen Henson [Tue, 28 Feb 2012 14:47:25 +0000 (14:47 +0000)]
Fix memory leak cause by race condition when creating public keys.
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.
Dr. Stephen Henson [Mon, 27 Feb 2012 18:45:06 +0000 (18:45 +0000)]
PR: 2736
Reported by: Remi Gacogne <rgacogne-bugs@coredump.fr>
Preserve unused bits value in non-canonicalised ASN1_STRING structures
by using ASN1_STRING_copy which preseves flags.
Dr. Stephen Henson [Mon, 27 Feb 2012 17:07:46 +0000 (17:07 +0000)]
xn is never actually used, remove it
Dr. Stephen Henson [Mon, 27 Feb 2012 16:46:54 +0000 (16:46 +0000)]
PR: 2737
Submitted by: Remi Gacogne <rgacogne-bugs@coredump.fr>
Fix double free in PKCS12_parse if we run out of memory.
Dr. Stephen Henson [Mon, 27 Feb 2012 16:33:16 +0000 (16:33 +0000)]
PR: 2735
Make cryptodev digests work. Thanks to Nikos Mavrogiannopoulos for
this fix.
Dr. Stephen Henson [Mon, 27 Feb 2012 16:27:00 +0000 (16:27 +0000)]
free headers after use in error message
Dr. Stephen Henson [Mon, 27 Feb 2012 15:23:04 +0000 (15:23 +0000)]
Detect symmetric crypto errors in PKCS7_decrypt.
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.
Dr. Stephen Henson [Thu, 23 Feb 2012 21:50:23 +0000 (21:50 +0000)]
PR: 2711
Submitted by: Tomas Mraz <tmraz@redhat.com>
Tolerate bad MIME headers in parser.
Dr. Stephen Henson [Thu, 23 Feb 2012 21:31:10 +0000 (21:31 +0000)]
PR: 2696
Submitted by: Rob Austein <sra@hactrn.net>
Fix inverted range problem in RFC3779 code.
Thanks to Andrew Chi for generating test cases for this bug.
Dr. Stephen Henson [Thu, 16 Feb 2012 15:21:46 +0000 (15:21 +0000)]
Fix bug in CVE-2011-4619: check we have really received a client hello
before rejecting multiple SGC restarts.
Dr. Stephen Henson [Sun, 12 Feb 2012 18:47:02 +0000 (18:47 +0000)]
PR: 2713
Submitted by: Tomas Mraz <tmraz@redhat.com>
Move libraries that are not needed for dynamic linking to Libs.private in
the .pc files
Dr. Stephen Henson [Sun, 12 Feb 2012 18:25:11 +0000 (18:25 +0000)]
PR: 2717
Submitted by: Tim Rice <tim@multitalents.net>
Make compilation work on OpenServer 5.0.7
Dr. Stephen Henson [Sat, 11 Feb 2012 23:12:48 +0000 (23:12 +0000)]
PR: 2703
Submitted by: Alexey Melnikov <alexey.melnikov@isode.com>
Fix some memory and resource leaks in CAPI ENGINE.
Dr. Stephen Henson [Sat, 11 Feb 2012 23:07:48 +0000 (23:07 +0000)]
PR: 2705
Submitted by: Alexey Melnikov <alexey.melnikov@isode.com>
Only create ex_data indices once for CAPI engine.
Dr. Stephen Henson [Fri, 10 Feb 2012 19:54:37 +0000 (19:54 +0000)]
PR: 2710
Submitted by: Tomas Mraz <tmraz@redhat.com>
Check return codes for load_certs_crls.
Andy Polyakov [Sat, 21 Jan 2012 11:35:29 +0000 (11:35 +0000)]
x86_64-xlate.pl: proper solution for RT#2620 [from HEAD].
Dr. Stephen Henson [Wed, 18 Jan 2012 14:27:57 +0000 (14:27 +0000)]
prepare for next version
Dr. Stephen Henson [Wed, 18 Jan 2012 13:38:34 +0000 (13:38 +0000)]
prepare for release
Dr. Stephen Henson [Wed, 18 Jan 2012 13:36:59 +0000 (13:36 +0000)]
update NEWS
Dr. Stephen Henson [Wed, 18 Jan 2012 13:36:04 +0000 (13:36 +0000)]
Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
Thanks to Antonio Martin, Enterprise Secure Access Research and
Development, Cisco Systems, Inc. for discovering this bug and
preparing a fix. (CVE-2012-0050)
Dr. Stephen Henson [Tue, 17 Jan 2012 14:19:51 +0000 (14:19 +0000)]
fix CHANGES entry
Andy Polyakov [Sun, 15 Jan 2012 13:40:40 +0000 (13:40 +0000)]
Fix OPNESSL vs. OPENSSL typos [from HEAD].
PR: 2613
Submitted by: Leena Heino
Andy Polyakov [Thu, 12 Jan 2012 16:37:20 +0000 (16:37 +0000)]
Sanitize usage of <ctype.h> functions. It's important that characters
are passed zero-extended, not sign-extended [from HEAD].
PR: 2682
Andy Polyakov [Thu, 12 Jan 2012 16:36:30 +0000 (16:36 +0000)]
asn1/t_x509.c: fix serial number print, harmonize with a_int.c [from HEAD].
PR: 2675
Submitted by: Annie Yousar