Dr. Stephen Henson [Fri, 6 Apr 2012 12:00:24 +0000 (12:00 +0000)]
Backport: Revise ssl code to use CERT_PKEY structure when outputting a certificate chain (from HEAD)
Dr. Stephen Henson [Fri, 6 Apr 2012 11:58:17 +0000 (11:58 +0000)]
Backport: tidy/enhance certificate chain output code (from HEAD)
Dr. Stephen Henson [Fri, 6 Apr 2012 11:36:35 +0000 (11:36 +0000)]
Backport: allow key agreement in SSL/TLS certificates (from HEAD)
Dr. Stephen Henson [Fri, 6 Apr 2012 11:35:45 +0000 (11:35 +0000)]
Backport: initialise dh_clnt (from HEAD)
Dr. Stephen Henson [Fri, 6 Apr 2012 11:34:42 +0000 (11:34 +0000)]
Backport DH client certificate support (from HEAD)
Dr. Stephen Henson [Fri, 6 Apr 2012 11:33:12 +0000 (11:33 +0000)]
Backport support for fixed DH ciphersuites (from HEAD)
Andy Polyakov [Thu, 5 Apr 2012 08:32:08 +0000 (08:32 +0000)]
aes-armv4.pl: make it more foolproof [inspired by aes-s390x.pl in 1.0.1].
Andy Polyakov [Thu, 5 Apr 2012 08:17:47 +0000 (08:17 +0000)]
aes-s390x.pl: fix endless loop in linux32-s390x build [from 1.0.1].
Andy Polyakov [Wed, 4 Apr 2012 20:50:58 +0000 (20:50 +0000)]
ssl/ssl_ciph.c: interim solution for assertion in d1_pkt.c(444) [from HEAD].
PR: 2778
Andy Polyakov [Sat, 31 Mar 2012 18:56:07 +0000 (18:56 +0000)]
CHANGES: harmonize with 1.0.0 and 1.0.1.
Dr. Stephen Henson [Sat, 31 Mar 2012 18:02:53 +0000 (18:02 +0000)]
PR: 2778(part)
Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com>
Time is always encoded as 4 bytes, not sizeof(Time).
Andy Polyakov [Sat, 31 Mar 2012 17:03:43 +0000 (17:03 +0000)]
modes_lcl.h: make it work on i386 [from HEAD].
PR: 2780
Andy Polyakov [Sat, 31 Mar 2012 16:55:34 +0000 (16:55 +0000)]
vpaes-x86[_64].pl: handle zero length in vpaes_cbc_encrypt [from HEAD].
PR: 2775
Andy Polyakov [Sat, 31 Mar 2012 11:07:09 +0000 (11:07 +0000)]
util/cygwin.sh update [from HEAD].
PR: 2761
Submitted by: Corinna Vinschen
Andy Polyakov [Fri, 30 Mar 2012 17:41:00 +0000 (17:41 +0000)]
bn/bn_gf2m.c: make new BN_GF2m_mod_inv work with BN_DEBUG_RAND [from HEAD].
Andy Polyakov [Thu, 29 Mar 2012 19:11:59 +0000 (19:11 +0000)]
ans1/tasn_prn.c: avoid bool in variable names [from HEAD].
PR: 2776
Andy Polyakov [Thu, 29 Mar 2012 19:11:08 +0000 (19:11 +0000)]
perlasm/x86masm.pl: fix last fix [from HEAD].
Dr. Stephen Henson [Thu, 22 Mar 2012 16:28:21 +0000 (16:28 +0000)]
fix leak
Dr. Stephen Henson [Thu, 22 Mar 2012 15:43:28 +0000 (15:43 +0000)]
Submitted by: Markus Friedl <mfriedl@gmail.com>
Fix memory leaks in 'goto err' cases.
Dr. Stephen Henson [Thu, 22 Mar 2012 15:29:21 +0000 (15:29 +0000)]
set version to 1.0.2-dev
cvs2svn [Wed, 21 Mar 2012 21:32:58 +0000 (21:32 +0000)]
This commit was manufactured by cvs2svn to create branch
'OpenSSL_1_0_2-stable'.
Dr. Stephen Henson [Wed, 21 Mar 2012 21:32:57 +0000 (21:32 +0000)]
use client version when deciding whether to send supported signature algorithms extension
Dr. Stephen Henson [Sun, 18 Mar 2012 18:16:05 +0000 (18:16 +0000)]
Always use SSLv23_{client,server}_method in s_client.c and s_server.c,
the old code came from SSLeay days before TLS was even supported.
Andy Polyakov [Fri, 16 Mar 2012 21:45:51 +0000 (21:45 +0000)]
bsaes-x86_64.pl: optimize key conversion [from HEAD].
Dr. Stephen Henson [Wed, 14 Mar 2012 22:20:40 +0000 (22:20 +0000)]
remove trailing slash
Richard Levitte [Wed, 14 Mar 2012 12:39:00 +0000 (12:39 +0000)]
cipher should only be set to PSK if JPAKE is used.
Dr. Stephen Henson [Wed, 14 Mar 2012 12:14:06 +0000 (12:14 +0000)]
update STATUS
Dr. Stephen Henson [Wed, 14 Mar 2012 12:04:40 +0000 (12:04 +0000)]
prepare for 1.0.1 release
Dr. Stephen Henson [Tue, 13 Mar 2012 22:49:27 +0000 (22:49 +0000)]
update NEWS
Andy Polyakov [Tue, 13 Mar 2012 19:21:15 +0000 (19:21 +0000)]
ssl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD].
Andy Polyakov [Tue, 13 Mar 2012 19:19:31 +0000 (19:19 +0000)]
x86_64-xlate.pl: remove old kludge.
PR: 2435,2440
Dr. Stephen Henson [Mon, 12 Mar 2012 16:29:47 +0000 (16:29 +0000)]
corrected fix to PR#2711 and also cover mime_param_cmp
Dr. Stephen Henson [Mon, 12 Mar 2012 16:27:50 +0000 (16:27 +0000)]
Fix for CMS/PKCS7 MMA. If RSA decryption fails use a random key and
continue with symmetric decryption process to avoid leaking timing
information to an attacker.
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
this issue. (CVE-2012-0884)
Dr. Stephen Henson [Sun, 11 Mar 2012 13:40:05 +0000 (13:40 +0000)]
PR: 2744
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>
CMS support for ccgost engine
Dr. Stephen Henson [Fri, 9 Mar 2012 18:37:41 +0000 (18:37 +0000)]
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Add more extension names in s_cb.c extension printing code.
Dr. Stephen Henson [Fri, 9 Mar 2012 15:52:20 +0000 (15:52 +0000)]
PR: 2756
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Fix DTLS timeout handling.
Dr. Stephen Henson [Thu, 8 Mar 2012 14:02:51 +0000 (14:02 +0000)]
check return value of BIO_write in PKCS7_decrypt
Dr. Stephen Henson [Tue, 6 Mar 2012 13:47:27 +0000 (13:47 +0000)]
PR: 2755
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Reduce MTU after failed transmissions.
Dr. Stephen Henson [Tue, 6 Mar 2012 13:24:16 +0000 (13:24 +0000)]
PR: 2748
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Fix possible DTLS timer deadlock.
Andy Polyakov [Sat, 3 Mar 2012 13:18:06 +0000 (13:18 +0000)]
Configure: make no-whirlpool work [from HEAD].
Richard Levitte [Thu, 1 Mar 2012 21:29:58 +0000 (21:29 +0000)]
On OpenVMS, try sha256 and sha512 et al as well.
Richard Levitte [Thu, 1 Mar 2012 21:29:16 +0000 (21:29 +0000)]
For OpenVMS, use inttypes.h instead of stdint.h
Dr. Stephen Henson [Wed, 29 Feb 2012 14:12:52 +0000 (14:12 +0000)]
PR: 2743
Reported by: Dmitry Belyavsky <beldmit@gmail.com>
Fix memory leak if invalid GOST MAC key given.
Dr. Stephen Henson [Wed, 29 Feb 2012 14:01:53 +0000 (14:01 +0000)]
PR: 2742
Reported by: Dmitry Belyavsky <beldmit@gmail.com>
If resigning with detached content in CMS just copy data across.
Dr. Stephen Henson [Tue, 28 Feb 2012 14:47:16 +0000 (14:47 +0000)]
Fix memory leak cause by race condition when creating public keys.
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.
Andy Polyakov [Tue, 28 Feb 2012 14:20:34 +0000 (14:20 +0000)]
x86cpuid.pl: fix processor capability detection on pre-586 [from HEAD].
Dr. Stephen Henson [Mon, 27 Feb 2012 18:45:18 +0000 (18:45 +0000)]
PR: 2736
Reported by: Remi Gacogne <rgacogne-bugs@coredump.fr>
Preserve unused bits value in non-canonicalised ASN1_STRING structures
by using ASN1_STRING_copy which preseves flags.
Dr. Stephen Henson [Mon, 27 Feb 2012 16:46:45 +0000 (16:46 +0000)]
PR: 2737
Submitted by: Remi Gacogne <rgacogne-bugs@coredump.fr>
Fix double free in PKCS12_parse if we run out of memory.
Dr. Stephen Henson [Mon, 27 Feb 2012 16:38:10 +0000 (16:38 +0000)]
PR: 2739
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Fix padding bugs in Heartbeat support.
Dr. Stephen Henson [Mon, 27 Feb 2012 16:33:25 +0000 (16:33 +0000)]
PR: 2735
Make cryptodev digests work. Thanks to Nikos Mavrogiannopoulos for
this fix.
Dr. Stephen Henson [Mon, 27 Feb 2012 16:27:09 +0000 (16:27 +0000)]
free headers after use in error message
Dr. Stephen Henson [Mon, 27 Feb 2012 15:22:54 +0000 (15:22 +0000)]
Detect symmetric crypto errors in PKCS7_decrypt.
Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for reporting this bug.
Andy Polyakov [Sun, 26 Feb 2012 22:03:41 +0000 (22:03 +0000)]
Configure: remove adding of -D_XPG4_2 -D__EXTENSIONS__ in sctp builds,
see corresponding commit to HEAD for details.
Andy Polyakov [Sun, 26 Feb 2012 21:53:28 +0000 (21:53 +0000)]
seed.c: Solaris portability fix from HEAD.
Dr. Stephen Henson [Sat, 25 Feb 2012 17:58:03 +0000 (17:58 +0000)]
PR: 2730
Submitted by: Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se>
VMS fixes: disable SCTP by default.
Dr. Stephen Henson [Thu, 23 Feb 2012 22:13:59 +0000 (22:13 +0000)]
correct CHANGES
Dr. Stephen Henson [Thu, 23 Feb 2012 21:50:32 +0000 (21:50 +0000)]
PR: 2711
Submitted by: Tomas Mraz <tmraz@redhat.com>
Tolerate bad MIME headers in parser.
Dr. Stephen Henson [Thu, 23 Feb 2012 21:31:22 +0000 (21:31 +0000)]
PR: 2696
Submitted by: Rob Austein <sra@hactrn.net>
Fix inverted range problem in RFC3779 code.
Thanks to Andrew Chi for generating test cases for this bug.
Dr. Stephen Henson [Thu, 23 Feb 2012 13:49:22 +0000 (13:49 +0000)]
PR: 2727
Submitted by: Bruce Stephens <bruce.stephens@isode.com>
Use same construct for EXHEADER in srp/Makefile as other makefiles to cope
with possibly empty EXHEADER.
Dr. Stephen Henson [Wed, 22 Feb 2012 14:01:44 +0000 (14:01 +0000)]
ABI compliance fixes.
Move new structure fields to end of structures.
Import library codes from 1.0.0 and recreate new ones.
Dr. Stephen Henson [Tue, 21 Feb 2012 14:21:32 +0000 (14:21 +0000)]
update NEWS
Dr. Stephen Henson [Fri, 17 Feb 2012 17:31:32 +0000 (17:31 +0000)]
typo
Dr. Stephen Henson [Thu, 16 Feb 2012 15:25:39 +0000 (15:25 +0000)]
Fix bug in CVE-2011-4619: check we have really received a client hello
before rejecting multiple SGC restarts.
Dr. Stephen Henson [Wed, 15 Feb 2012 14:14:01 +0000 (14:14 +0000)]
Additional compatibility fix for MDC2 signature format.
Update RSA EVP_PKEY_METHOD to use the OCTET STRING form of MDC2 signature:
this will make all versions of MDC2 signature equivalent.
Dr. Stephen Henson [Wed, 15 Feb 2012 14:00:09 +0000 (14:00 +0000)]
An incompatibility has always existed between the format used for RSA
signatures and MDC2 using EVP or RSA_sign. This has become more apparent
when the dgst utility in OpenSSL 1.0.0 and later switched to using the
EVP_DigestSign functions which call RSA_sign.
This means that the signature format OpenSSL 1.0.0 and later used with
dgst -sign and MDC2 is incompatible with previous versions.
Add detection in RSA_verify so either format works.
Note: MDC2 is disabled by default in OpenSSL and very rarely used in practice.
Dr. Stephen Henson [Sun, 12 Feb 2012 23:20:21 +0000 (23:20 +0000)]
PR: 2708
Submitted by: Bruce Stephens <bruce.stephens@isode.com>
Translate path separators correctly for $fipsdir in util/mk1mf.pl
Dr. Stephen Henson [Sun, 12 Feb 2012 18:47:36 +0000 (18:47 +0000)]
PR: 2713
Submitted by: Tomas Mraz <tmraz@redhat.com>
Move libraries that are not needed for dynamic linking to Libs.private in
the .pc files
Dr. Stephen Henson [Sat, 11 Feb 2012 23:38:49 +0000 (23:38 +0000)]
PR: 2717
Submitted by: Tim Rice <tim@multitalents.net>
Make compilation work on OpenServer 5.0.7
Dr. Stephen Henson [Sat, 11 Feb 2012 23:21:09 +0000 (23:21 +0000)]
PR: 2716
Submitted by: Adam Langley <agl@google.com>
Fix handling of exporter return value and use OpenSSL indentation in
s_client, s_server.
Dr. Stephen Henson [Sat, 11 Feb 2012 23:12:59 +0000 (23:12 +0000)]
PR: 2703
Submitted by: Alexey Melnikov <alexey.melnikov@isode.com>
Fix some memory and resource leaks in CAPI ENGINE.
Dr. Stephen Henson [Sat, 11 Feb 2012 23:07:58 +0000 (23:07 +0000)]
PR: 2705
Submitted by: Alexey Melnikov <alexey.melnikov@isode.com>
Only create ex_data indices once for CAPI engine.
Dr. Stephen Henson [Sat, 11 Feb 2012 22:53:48 +0000 (22:53 +0000)]
Submitted by: Eric Rescorla <ekr@rtfm.com>
Further fixes for use_srtp extension.
Andy Polyakov [Sat, 11 Feb 2012 13:31:16 +0000 (13:31 +0000)]
apps/s_cb.c: recognize latest TLS versions [from HEAD].
Dr. Stephen Henson [Fri, 10 Feb 2012 20:08:49 +0000 (20:08 +0000)]
PR: 2704
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Fix srp extension.
Dr. Stephen Henson [Fri, 10 Feb 2012 19:54:46 +0000 (19:54 +0000)]
PR: 2710
Submitted by: Tomas Mraz <tmraz@redhat.com>
Check return codes for load_certs_crls.
Dr. Stephen Henson [Fri, 10 Feb 2012 19:44:00 +0000 (19:44 +0000)]
PR: 2714
Submitted by: Tomas Mraz <tmraz@redhat.com>
Make no-srp work.
Dr. Stephen Henson [Fri, 10 Feb 2012 16:54:56 +0000 (16:54 +0000)]
only cleanup ctx if we need to, save ctx flags when we do
Dr. Stephen Henson [Fri, 10 Feb 2012 16:46:19 +0000 (16:46 +0000)]
add fips hmac option and fips blocking overrides to command line utilities
Dr. Stephen Henson [Fri, 10 Feb 2012 00:03:37 +0000 (00:03 +0000)]
Submitted by: Eric Rescorla <ekr@rtfm.com>
Fix encoding of use_srtp extension to be compliant with RFC5764
Dr. Stephen Henson [Thu, 9 Feb 2012 15:41:44 +0000 (15:41 +0000)]
Modify client hello version when renegotiating to enhance interop with
some servers.
Andy Polyakov [Thu, 2 Feb 2012 07:46:19 +0000 (07:46 +0000)]
bn_nist.c: make new optimized code dependent on BN_LLONG [from HEAD].
Andy Polyakov [Thu, 2 Feb 2012 07:42:31 +0000 (07:42 +0000)]
hpux-parisc2-*: engage assembler [from HEAD] and make it link.
Andy Polyakov [Wed, 25 Jan 2012 17:56:25 +0000 (17:56 +0000)]
ghash-x86.pl: engage original MMX version in no-sse2 builds [from HEAD].
Andy Polyakov [Wed, 25 Jan 2012 17:50:23 +0000 (17:50 +0000)]
x86_64-xlate.pl: 1.0.1-specific typo.
Dr. Stephen Henson [Tue, 24 Jan 2012 23:00:36 +0000 (23:00 +0000)]
only include bn.h once
Dr. Stephen Henson [Tue, 24 Jan 2012 22:59:46 +0000 (22:59 +0000)]
only include evp.h once
Dr. Stephen Henson [Tue, 24 Jan 2012 22:58:46 +0000 (22:58 +0000)]
only include string.h once
Dr. Stephen Henson [Sun, 22 Jan 2012 13:12:50 +0000 (13:12 +0000)]
return error if md is NULL
Andy Polyakov [Sat, 21 Jan 2012 12:18:29 +0000 (12:18 +0000)]
cryptlib.c: make even non-Windows builds "strtoull-agnostic" [from HEAD].
Andy Polyakov [Sat, 21 Jan 2012 11:35:20 +0000 (11:35 +0000)]
x86_64-xlate.pl: proper solution for RT#2620 [from HEAD].
Dr. Stephen Henson [Thu, 19 Jan 2012 17:14:17 +0000 (17:14 +0000)]
change version to beta3-dev
Dr. Stephen Henson [Thu, 19 Jan 2012 15:46:43 +0000 (15:46 +0000)]
update files for beta2 release
Dr. Stephen Henson [Thu, 19 Jan 2012 15:37:57 +0000 (15:37 +0000)]
prepare for beta2
Dr. Stephen Henson [Wed, 18 Jan 2012 18:14:56 +0000 (18:14 +0000)]
Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
Thanks to Antonio Martin, Enterprise Secure Access Research and
Development, Cisco Systems, Inc. for discovering this bug and
preparing a fix. (CVE-2012-0050)
Dr. Stephen Henson [Wed, 18 Jan 2012 01:40:36 +0000 (01:40 +0000)]
undef some symbols that cause problems with make depend for fips builds
Dr. Stephen Henson [Tue, 17 Jan 2012 14:19:09 +0000 (14:19 +0000)]
fix CHANGES entry
Andy Polyakov [Sun, 15 Jan 2012 13:42:50 +0000 (13:42 +0000)]
1.0.1-specific OPNESSL vs. OPENSSL typo.
PR: 2613
Submitted by: Leena Heino
Andy Polyakov [Sun, 15 Jan 2012 13:40:21 +0000 (13:40 +0000)]
Fix OPNESSL vs. OPENSSL typos [from HEAD].
PR: 2613
Submitted by: Leena Heino
Dr. Stephen Henson [Sun, 15 Jan 2012 13:30:52 +0000 (13:30 +0000)]
fix warning
Andy Polyakov [Thu, 12 Jan 2012 16:28:03 +0000 (16:28 +0000)]
Sanitize usage of <ctype.h> functions. It's important that characters
are passed zero-extended, not sign-extended [from HEAD].
PR: 2682