Alessandro Ghedini [Mon, 9 May 2016 11:59:26 +0000 (12:59 +0100)]
Do not access SSL struct directly in TLS1_get_version and TLS1_get_client_version macros
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Alessandro Ghedini [Mon, 9 May 2016 11:58:01 +0000 (12:58 +0100)]
Add SSL_client_version() getter function
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Fri, 6 May 2016 09:19:35 +0000 (10:19 +0100)]
Add some documentation of SSL_CTX_set_tlsext_status_type()
The previous commit added SSL_CTX_set_tlsext_status_type(). This one adds
some documentation for it.
Reviewed-by: Rich Salz <rsalz@openssl.org>
jfigus [Tue, 2 Dec 2014 20:44:49 +0000 (15:44 -0500)]
Propagate tlsext_status_type from SSL_CTX to SSL
To allow OCSP stapling to work with libcurl.
Github PR #200
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Kazuki Yamaguchi [Sat, 12 Dec 2015 15:51:06 +0000 (00:51 +0900)]
Fix NPN protocol name list validation
Since
50932c4 "PACKETise ServerHello processing",
ssl_next_proto_validate() incorrectly allows empty protocol name.
draft-agl-tls-nextprotoneg-04[1] says "Implementations MUST ensure that
the empty string is not included and that no byte strings are
truncated."
This patch restores the old correct behavior.
[1] https://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
FdaSilvaYY [Mon, 7 Mar 2016 21:45:58 +0000 (22:45 +0100)]
Unify <TYPE>_up_ref methods signature and behaviour.
Add a status return value instead of void.
Add some sanity checks on reference counter value.
Update the docs.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Mon, 16 May 2016 07:48:15 +0000 (09:48 +0200)]
Small MSVC build fixes.
- "/Ox /O2 /Ob2" get's reduced to "/O2", the reason being:
/Ox = /Ob2 /Og /Oi /Ot /Oy /Gs
/O2 = /Ob2 /Og /Oi /Ot /Oy /Gs /GF /Gy
- apps/openssl.cnf gets installed.
- always delete files quietly, as they might not be there.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1075)
FdaSilvaYY [Wed, 11 May 2016 22:29:22 +0000 (00:29 +0200)]
Fix some missing OBJ_dup failure checks.
Fix some missing OBJ_dup failure checks.
Merged from
https://boringssl.googlesource.com/boringssl/+/
0ce78a757d815c0dde9ed5884229f3a5b2cb3e9c%5E!
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1057)
Richard Levitte [Sat, 14 May 2016 08:51:58 +0000 (10:51 +0200)]
openssl_{startup,shutdown}.com.in are in the source directory
Reviewed-by: Rich Salz <rsalz@openssl.org>
FdaSilvaYY [Mon, 9 May 2016 16:48:13 +0000 (18:48 +0200)]
Fix various methods declaration in pod file
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1042)
Alessandro Ghedini [Fri, 25 Sep 2015 15:53:58 +0000 (17:53 +0200)]
Increment size limit for ClientHello messages
The current limit of 2^14 bytes is too low (e.g. RFC 5246 specifies the
maximum size of just the extensions field to be 2^16-1), and may cause
bogus failures.
RT#4063
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/413)
Kirill Marinushkin [Thu, 5 May 2016 18:51:07 +0000 (20:51 +0200)]
Fix engine cryptodev: pointer to IV
Currently point to wrong address
Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Insu Yun [Thu, 5 May 2016 15:39:16 +0000 (11:39 -0400)]
Fix OpenSSL_memdup error handling
check source's kdf_ukm, not destination's
use != NULL, instead of implicit checking
don't free internal data structure like pkey_rsa_copy()
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Fri, 13 May 2016 09:21:06 +0000 (11:21 +0200)]
VMS perl: Fix glob output
In some cases, perl's glob() thinks it needs to return file names with
generation numbers, such as when a file name pattern includes two
periods. Constructing other file names by simple appending to file
names with generation numbers isn't a good idea, so for the VMS case,
just peal the generation numbers if they are there.
Fortunately, this is easy, as the returned generation number delimiter
will always be a semi-colon.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Wed, 11 May 2016 11:32:12 +0000 (12:32 +0100)]
Add some additional NewSessionTicket tests
If the server does not send a session ticket extension, it should not then
send the NewSessionTicket message.
If the server sends the session ticket extension, it MUST then send the
NewSessionTicket message.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
David Benjamin [Sun, 6 Mar 2016 00:35:52 +0000 (19:35 -0500)]
The NewSessionTicket message is not optional.
Per RFC 4507, section 3.3:
This message [NewSessionTicket] MUST be sent if the
server included a SessionTicket extension in the ServerHello. This
message MUST NOT be sent if the server did not include a
SessionTicket extension in the ServerHello.
The presence of the NewSessionTicket message should be determined
entirely from the ServerHello without probing.
RT#4389
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Fri, 13 May 2016 11:23:52 +0000 (12:23 +0100)]
Fix stack constification definitions.
RT#4471
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Thu, 12 May 2016 14:02:04 +0000 (15:02 +0100)]
Correct documentation on digest used.
RT#4302
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Dr. Stephen Henson [Thu, 12 May 2016 16:13:50 +0000 (17:13 +0100)]
Fix signer option and support format SMIME.
Fix -signer option in smime utility to output signer certificates
when verifying.
Add support for format SMIME for -inform and -outform with cms and
smime utilities.
PR#4215
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Richard Levitte [Thu, 12 May 2016 16:08:21 +0000 (18:08 +0200)]
Windows: When installing libraries and executables, install .pdb files as well
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Tue, 10 May 2016 12:41:19 +0000 (14:41 +0200)]
DJGPP adjustments
* Configure: Replaced -DTERMIO by -DTERMIOS in CFLAGS.
* crypto/bio/bss_dgram.c [WATT32]: Remove obsolete redefinition of
function names: sock_write, sock_read and sock_puts.
* crypto/bio/bss_sock.c [WATT32]: For Watt-32 2.2.11 sock_write,
sock_read and sock_puts are redefined to their private names so
their names must be undefined first before they can be redefined
again.
* crypto/bio/bss_file.c (file_fopen) [__DJGPP__]: Make a copy of the
passed file name and replace the leading dots in the dirname part
and the basname part of the file name, unless LFN is supported.
* e_os.h [__DJGPP__]: Undefine macro DEVRANDOM_EGD. Neither MS-DOS nor
FreeDOS provide 'egd' sockets.
New macro HAS_LFN_SUPPORT checks if underlying file system supports
long file names or not.
Include sys/un.h.
Define WATT32_NO_OLDIES.
* INSTALL.DJGPP: Update URL of WATT-32 library.
Submitted by Juan Manuel Guerrero <juan.guerrero@gmx.de>
RT#4217
Reviewed-by: Andy Polyakov <appro@openssl.org>
Richard Levitte [Wed, 11 May 2016 11:47:19 +0000 (13:47 +0200)]
Move the DJGPP target to its own config.
DJGPP is a 3rd party configuration, we rely entirely on the OpenSSL to
help us fine tune and test. Therefore, it's moved to its own config.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Rich Salz [Thu, 12 May 2016 20:08:01 +0000 (16:08 -0400)]
Fix uninitialized variable
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Emilia Kasper [Thu, 7 Apr 2016 17:07:50 +0000 (19:07 +0200)]
Remove proxy tests. Add verify callback tests.
The old proxy tests test the implementation of an application proxy
policy callback defined in the test itself, which is not particularly
useful.
It is, however, useful to test cert verify overrides in
general. Therefore, replace these tests with tests for cert verify
callback behaviour.
Also glob the ssl test inputs on the .in files to catch missing
generated files.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Wed, 11 May 2016 20:41:29 +0000 (22:41 +0200)]
Appease ubsan
ERR_LIB_USER has value 128, and shifting into the sign bit upsets the
shift sanitizer.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Thu, 12 May 2016 14:24:06 +0000 (15:24 +0100)]
Correctly check for trailing digest options.
Multiple digest options to the ocsp utility are allowed: e.g. to use
different digests for different certificate IDs. A digest option without
a following certificate is however illegal.
RT#4215
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Wed, 11 May 2016 07:12:32 +0000 (09:12 +0200)]
Remove openssl.spec
While it seemed like a good idea to have this file once upon a time,
this kind of file belongs with the package maintainer rather than in
our source.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Tue, 10 May 2016 14:19:56 +0000 (15:19 +0100)]
Restore support for ENGINE format keys in apps.
RT#4207
Reviewed-by: Tim Hudson <tjh@openssl.org>
Dmitry Belyavsky [Wed, 11 May 2016 20:00:12 +0000 (21:00 +0100)]
Don't use GOST ciphersuites with DTLS.
RT#4438
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Dr. Stephen Henson [Wed, 11 May 2016 20:14:57 +0000 (21:14 +0100)]
Don't leak memory if realloc fails.
RT#4403
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Richard Levitte [Tue, 10 May 2016 21:22:29 +0000 (23:22 +0200)]
Add a case for 64-bit OS X in config
This makes it possible to just run ./config on a x86_64 machine with
no extra fuss.
RT#4356
Reviewed-by: Tim Hudson <tjh@openssl.org>
Viktor Dukhovni [Wed, 11 May 2016 22:01:41 +0000 (18:01 -0400)]
Fix TLSProxy race by adding missing eval
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Tue, 26 Apr 2016 19:50:28 +0000 (15:50 -0400)]
Recommend GH over RT, per team vote.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Wed, 11 May 2016 20:12:57 +0000 (22:12 +0200)]
make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Wed, 11 May 2016 18:14:54 +0000 (19:14 +0100)]
typo
RT#4442
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Dr. Stephen Henson [Wed, 11 May 2016 11:41:58 +0000 (12:41 +0100)]
Update pkcs8 defaults.
Update pkcs8 utility to use 256 bit AES using SHA256 by default.
Update documentation.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Steven Valdez [Tue, 1 Mar 2016 18:20:43 +0000 (13:20 -0500)]
Adding missing BN_CTX_(start/end) in crypto/ec/ec_key.c
RT#4363
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Emilia Kasper [Wed, 6 Apr 2016 14:03:06 +0000 (16:03 +0200)]
Replace cipherlist test
The old cipherlist test in ssltest.c only tests the internal order of
the cipher table, which is pretty useless.
Replace this test with a test that catches inadvertent changes to the
default cipherlist.
Fix run_tests.pl to correctly filter tests that have "list" in their name.
(Also includes a small drive-by fix in .gitignore.)
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Wed, 11 May 2016 10:50:12 +0000 (11:50 +0100)]
Make null_compression const
Reviewed-by: Stephen Henson <steve@openssl.org>
David Benjamin [Sat, 5 Mar 2016 18:14:11 +0000 (13:14 -0500)]
Fix V2ClientHello handling.
The V2ClientHello code creates an empty compression list, but the
compression list must explicitly contain the null compression (and later
code enforces this).
RT#4387
Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Tue, 10 May 2016 19:30:00 +0000 (20:30 +0100)]
Add -signcert to CA.pl usage message.
RT#4256
Reviewed-by: Matt Caswell <matt@openssl.org>
Viktor Dukhovni [Mon, 2 May 2016 18:46:51 +0000 (14:46 -0400)]
Fix i2d_X509_AUX, update docs and add tests
When *pp is NULL, don't write garbage, return an unexpected pointer
or leak memory on error.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Dr. Stephen Henson [Tue, 10 May 2016 19:49:50 +0000 (20:49 +0100)]
Add a couple of checks to prime app.
RT#4402
Reviewed-by: Richard Levitte <levitte@openssl.org>
Dr. Stephen Henson [Tue, 10 May 2016 21:13:03 +0000 (22:13 +0100)]
Add -srp option to ciphers command.
RT#4224
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 9 May 2016 09:20:35 +0000 (11:20 +0200)]
crypto/des: remove obsolete functions.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 4 May 2016 13:34:02 +0000 (15:34 +0200)]
Configurations: engage MIPS64 Poly1305 module.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 4 May 2016 13:33:42 +0000 (15:33 +0200)]
MIPS64 assembly pack: add Poly1305 module.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 9 May 2016 15:12:13 +0000 (17:12 +0200)]
Configure: replace which() with IPC::Cmd::can_run.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 9 May 2016 22:06:11 +0000 (00:06 +0200)]
windows-makefile.tmpl: minor adjustments.
- some Perl versions are allergic to missing ';';
- don't stop if del fails;
- omit unused environment variable;
Reviewed-by: Stephen Henson <steve@openssl.org>
Andy Polyakov [Mon, 9 May 2016 21:50:43 +0000 (23:50 +0200)]
util/mkdef.pl: omit ordinals from Windows DLLs.
Reviewed-by: Stephen Henson <steve@openssl.org>
Dr. Stephen Henson [Tue, 10 May 2016 15:39:52 +0000 (16:39 +0100)]
Typo.
RT#4538
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Tue, 10 May 2016 11:12:01 +0000 (13:12 +0200)]
Fix the docs for ERR_remove_thread_state and ERR_remove_state
Don't primarly recommend using OPENSSL_thread_stop(), as that's a last
resort. Instead, recommend leaving it to automatic mechanisms.
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Sun, 8 May 2016 15:01:09 +0000 (17:01 +0200)]
Restore the ERR_remove_thread_state() API and make it a no-op
The ERR_remove_thread_state() API is restored to take a pointer
argument, but does nothing more. ERR_remove_state() is also made into
a no-op. Both functions are deprecated and users are recommended to
use OPENSSL_thread_stop() instead.
Documentation is changed to reflect this.
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Tue, 10 May 2016 05:54:32 +0000 (07:54 +0200)]
Have [.VMS]openssl_{startup,shutdown}.com depend on respective *.in
Reviewed-by: Andy Polyakov <appro@openssl.org>
Richard Levitte [Mon, 9 May 2016 20:59:02 +0000 (22:59 +0200)]
Fix VMS/openssl_{startup,shutddown}.com.in
They were using the wrong variables.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Andy Polyakov [Mon, 9 May 2016 13:35:55 +0000 (15:35 +0200)]
Configure: adhere to $(CROSS_COMPILE)ranlib.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 9 May 2016 09:44:10 +0000 (11:44 +0200)]
Configure: make it work with Perl 5.10.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 4 May 2016 21:40:47 +0000 (23:40 +0200)]
IRIX fixes.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Mon, 9 May 2016 19:52:11 +0000 (21:52 +0200)]
Add NULL check in i2d_PrivateKey()
Originally submitted by Kurt Cancemi <kurt@x64architecture.com>
Closes RT#4533
Reviewed-by: Matt Caswell <matt@openssl.org>
David Benjamin [Sun, 6 Mar 2016 00:49:20 +0000 (19:49 -0500)]
Don't send signature algorithms when client_version is below TLS 1.2.
Per RFC 5246,
Note: this extension is not meaningful for TLS versions prior to 1.2.
Clients MUST NOT offer it if they are offering prior versions.
However, even if clients do offer it, the rules specified in [TLSEXT]
require servers to ignore extensions they do not understand.
Although second sentence would suggest that there would be no interop
problems in always offering the extension, WebRTC has reported issues
with Bouncy Castle on < TLS 1.2 ClientHellos that still include
signature_algorithms. See also
https://bugs.chromium.org/p/webrtc/issues/detail?id=4223
RT#4390
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Matt Caswell [Mon, 9 May 2016 14:04:11 +0000 (15:04 +0100)]
Fix BIO_eof() for BIO pairs
BIO_eof() was always returning true when using a BIO pair. It should only
be true if the peer BIO is empty and has been shutdown.
RT#1215
Reviewed-by: Richard Levitte <levitte@openssl.org>
Hansruedi Patzen [Sat, 20 Feb 2016 16:27:02 +0000 (17:27 +0100)]
Fix: failed to open config file if not specified when using CA commands
Issue was introduced in
https://github.com/openssl/openssl/commit/
a0a82324f965bbcc4faed4e1ee3fcaf81ea52166
This patch fixes an issue which causes the 'openssl ca' commands to
fail if '-config' is not specified even if it says so otherwise.
Problem is that the default config is not loaded and the conf variable
is NULL which causes an exception.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Sun, 8 May 2016 14:57:55 +0000 (16:57 +0200)]
VMS: support VERBOSE and V in descrip.mms
With Unixly Makefiles as well as with nmake, make variables are
transferred to the shell running the commands as envinronment
variables. This principle doesn't apply with MMS, so we must
explicitely define VERBOSE as commands when it's needed.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sun, 8 May 2016 12:09:56 +0000 (13:09 +0100)]
Recognise VERBOSE and V as well as HARNESS_VERBOSE
PR#4462
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Mon, 9 May 2016 12:56:35 +0000 (08:56 -0400)]
Missing credit in CHANGES
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andrea Grandi [Tue, 3 May 2016 02:24:48 +0000 (03:24 +0100)]
Fix error in the loop of ECDH
The tests was incorrectly repeated multiple times when using the
async_jobs options
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Thu, 5 May 2016 19:59:03 +0000 (20:59 +0100)]
Free any existing SRTP connection profile
When setting a new SRTP connection profile using
SSL_CTX_set_tlsext_use_srtp() or SSL_set_tlsext_use_srtp() we should
free any existing profile first to avoid a memory leak.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Andy Polyakov [Fri, 6 May 2016 10:45:50 +0000 (12:45 +0200)]
Configurations/windows-makefile.tmpl: expand environments early.
If environment variables are not explanded early enough, expanded
strings are passed with single backslash to C compiler, e.g.
C:\Program Files, which effectively results in OpenSSL looking for
engines and certificates in C:Program Files.
Reviewed-by: Richard Levitte <levitte@openssl.org>
FdaSilvaYY [Tue, 3 May 2016 20:40:33 +0000 (22:40 +0200)]
fix tab-space mixed indentation
No code change
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
J Mohan Rao Arisankala [Fri, 6 May 2016 01:35:44 +0000 (07:05 +0530)]
fix check
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
J Mohan Rao Arisankala [Thu, 5 May 2016 18:13:32 +0000 (23:43 +0530)]
few missing allocation failure checks and releases on error paths
- Missing checks for allocation failure.
- releasing memory in few missing error paths
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Ben Laurie [Wed, 4 May 2016 10:45:49 +0000 (11:45 +0100)]
memset() doesn't take NULL.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Ben Laurie [Sat, 26 Mar 2016 17:19:14 +0000 (17:19 +0000)]
Add fuzzing!
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Dr. Stephen Henson [Fri, 6 May 2016 02:46:09 +0000 (03:46 +0100)]
Constify PKCS12_newpass()
PR#4449
Reviewed-by: Rich Salz <rsalz@openssl.org>
Jeffrey Walton [Thu, 5 May 2016 13:26:26 +0000 (14:26 +0100)]
Add documentation of PKCS12_newpass()
PR#4478
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
Dr. Stephen Henson [Thu, 5 May 2016 14:37:23 +0000 (15:37 +0100)]
Tidy up PKCS12_newpass() fix memory leaks.
PR#4466
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Fri, 6 May 2016 18:27:49 +0000 (19:27 +0100)]
Only set CMS parameter when encrypting
Reviewed-by: Rich Salz <rsalz@openssl.org>
isnotnick [Tue, 16 Dec 2014 15:25:59 +0000 (16:25 +0100)]
RT3513: req doesn't display attributes using utf8string
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Thu, 5 May 2016 15:07:06 +0000 (17:07 +0200)]
README.PERL: clarify "matching" Perl requirement on Windows.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Wed, 4 May 2016 21:53:06 +0000 (23:53 +0200)]
poly1305/asm/poly1305-x86_64.pl: contain symbols within shared lib.
We don't need it, but external users might find it handy.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 4 May 2016 21:45:35 +0000 (23:45 +0200)]
poly1305/asm/poly1305-x86_64.pl: make it cross-compile.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 4 May 2016 21:42:57 +0000 (23:42 +0200)]
testlib/OpenSSL/Test.pm: address 5.10 warnings.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Sat, 23 Apr 2016 17:14:21 +0000 (19:14 +0200)]
test/evp_test.c: exercise different combinations of data misalignment.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Dr. Stephen Henson [Thu, 5 May 2016 21:17:05 +0000 (22:17 +0100)]
Use default ASN.1 for SEED.
The default ASN.1 handling can be used for SEED. This also makes
CMS work with SEED.
PR#4504
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Thu, 5 May 2016 21:44:44 +0000 (22:44 +0100)]
typo
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Thu, 5 May 2016 21:08:41 +0000 (17:08 -0400)]
Move 3DES from HIGH to MEDIUM
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Dr. Stephen Henson [Mon, 21 Mar 2016 15:48:51 +0000 (15:48 +0000)]
Always try to set ASN.1 parameters for CMS.
Try to set the ASN.1 parameters for CMS encryption even if the IV
length is zero as the underlying cipher should still set the type.
This will correctly result in errors if an attempt is made to use
an unsupported cipher type.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Sergio Garcia Murillo [Thu, 5 May 2016 21:27:30 +0000 (17:27 -0400)]
GH356: Change assert to normal error
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 3 May 2016 16:55:00 +0000 (17:55 +0100)]
Handle no async jobs in libssl
If the application has limited the size of the async pool using
ASYNC_init_thread() then we could run out of jobs while trying to start a
libssl io operation. However libssl was failing to handle this and treating
it like a fatal error. It should not be fatal...we just need to retry when
there are jobs available again.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Emilia Kasper [Fri, 29 Apr 2016 17:19:58 +0000 (19:19 +0200)]
Document inversion ladder in curve25519
This demystifies two for-loops that do nothing. They were used to write
the ladder in a unified way. Now that the ladder is otherwise commented,
remove the dead loops.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Thu, 5 May 2016 14:21:46 +0000 (10:21 -0400)]
Script changed; update the generated file.
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Matt Caswell [Thu, 5 May 2016 15:04:22 +0000 (16:04 +0100)]
Improve heartbeats coding style
Based on an orignal commit by GitHub user BertramScharpf. Rebased and
updated to take account of all the updates since this was first raised.
GH PR#62
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Sun, 1 May 2016 12:47:43 +0000 (08:47 -0400)]
Tweak generated warning lines.
Reviewed-by: Andy Polyakov <appro@openssl.org>
J Mohan Rao Arisankala [Fri, 26 Feb 2016 06:07:08 +0000 (11:37 +0530)]
remove unused macros in list -disabled
list -disabled was checking OPENSSL_NO_SSL/OPENSSL_NO_TLS, which are
not used to disable SSL/TLS respectively.
Building with these macros wrongly show as SSL/TLS disabled, hence
removing this code.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
FdaSilvaYY [Tue, 3 May 2016 17:34:03 +0000 (19:34 +0200)]
Fix spelling
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
GH: #1021
Dr. Stephen Henson [Wed, 4 May 2016 13:50:14 +0000 (14:50 +0100)]
support embed in ASN.1 print
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Wed, 4 May 2016 17:26:59 +0000 (19:26 +0200)]
Complete the list of names in doc/ssl/SSL_CTX_load_verify_locations.pod
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Wed, 4 May 2016 15:09:06 +0000 (16:09 +0100)]
Fix name length limit check.
The name length limit check in x509_name_ex_d2i() includes
the containing structure as well as the actual X509_NAME. This will
cause large CRLs to be rejected.
Fix by limiting the length passed to ASN1_item_ex_d2i() which will
then return an error if the passed X509_NAME exceeds the length.
RT#4531
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Wed, 4 May 2016 12:44:10 +0000 (14:44 +0200)]
Check return of PEM_write_* functions and report possible errors
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1025)
Marek Klein [Tue, 3 May 2016 08:48:47 +0000 (08:48 +0000)]
DEFINE_STACK_OF(ASN1_UTF8STRING) moved from ts_lcl.h to asn1.h
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1020)