Dr. Stephen Henson [Tue, 6 Apr 2010 12:29:21 +0000 (12:29 +0000)]
PR: 2223
Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de>
Fixes for DTLS timeout bug
Dr. Stephen Henson [Tue, 6 Apr 2010 11:18:32 +0000 (11:18 +0000)]
PR: 2220
Fixes to make OpenSSL compile with no-rc4
Dr. Stephen Henson [Tue, 30 Mar 2010 00:55:00 +0000 (00:55 +0000)]
updates for next release
Dr. Stephen Henson [Mon, 29 Mar 2010 13:11:54 +0000 (13:11 +0000)]
Prepare for 1.0.0 release - finally ;-)
Andy Polyakov [Mon, 29 Mar 2010 09:59:58 +0000 (09:59 +0000)]
ARMv4 assembler: [unconfirmed] fix for compilation failure [from HEAD].
Andy Polyakov [Mon, 29 Mar 2010 09:50:33 +0000 (09:50 +0000)]
dso_dlfcn.c: fix compile failure on Tru64 [from HEAD].
Dr. Stephen Henson [Sun, 28 Mar 2010 00:42:29 +0000 (00:42 +0000)]
PR: 1696
Check return value if d2i_PBEPARAM().
Dr. Stephen Henson [Sat, 27 Mar 2010 23:28:23 +0000 (23:28 +0000)]
PR: 1763
Remove useless num = 0 assignment.
Remove redundant cases on sock_ctrl(): default case handles them.
Dr. Stephen Henson [Sat, 27 Mar 2010 19:27:51 +0000 (19:27 +0000)]
PR: 1904
Submitted by: David Woodhouse <dwmw2@infradead.org>
Pass passphrase minimum length down to UI.
Dr. Stephen Henson [Sat, 27 Mar 2010 18:28:13 +0000 (18:28 +0000)]
PR: 1813
Submitted by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Fix memory leak when engine name cannot be loaded.
Dr. Stephen Henson [Thu, 25 Mar 2010 12:07:45 +0000 (12:07 +0000)]
update FAQ
Bodo Möller [Thu, 25 Mar 2010 11:22:42 +0000 (11:22 +0000)]
Fix for "Record of death" vulnerability CVE-2010-0740.
Also, add missing CHANGES entry for CVE-2009-3245 (code changes submitted to this branch on 23 Feb 2010).
Dr. Stephen Henson [Wed, 24 Mar 2010 23:42:20 +0000 (23:42 +0000)]
initialise buf if wrong_info not used
Dr. Stephen Henson [Wed, 24 Mar 2010 23:16:49 +0000 (23:16 +0000)]
PR: 1731 and maybe 2197
Clear error queue in a few places in SSL code where errors are expected
so they don't stay in the queue.
Andy Polyakov [Mon, 22 Mar 2010 22:44:35 +0000 (22:44 +0000)]
rand_win.c: fix logical bug in readscreen [from HEAD].
Andy Polyakov [Mon, 22 Mar 2010 22:39:46 +0000 (22:39 +0000)]
bss_file.c: fix MSC 6.0 warning [from HEAD].
Andy Polyakov [Mon, 15 Mar 2010 22:29:20 +0000 (22:29 +0000)]
e_capi.c: fix typo.
Andy Polyakov [Mon, 15 Mar 2010 22:26:33 +0000 (22:26 +0000)]
Fix UPLINK typo [from HEAD].
Dr. Stephen Henson [Mon, 15 Mar 2010 13:09:39 +0000 (13:09 +0000)]
workaround for missing definition in some headers
Dr. Stephen Henson [Fri, 12 Mar 2010 12:48:46 +0000 (12:48 +0000)]
PR: 2192
Submitted By: Jaroslav Imrich <jaroslav.imrich@disig.sk>
The prompt_info and wrong_info parameters can be empty strings which
can produce confusing prompts. Treat empty string same as NULL.
Dr. Stephen Henson [Fri, 12 Mar 2010 12:07:05 +0000 (12:07 +0000)]
missing goto meant signature was never printed out
Dr. Stephen Henson [Wed, 10 Mar 2010 13:48:21 +0000 (13:48 +0000)]
don't leave bogus errors in the queue
Dr. Stephen Henson [Tue, 9 Mar 2010 17:23:51 +0000 (17:23 +0000)]
make update
Dr. Stephen Henson [Tue, 9 Mar 2010 17:18:17 +0000 (17:18 +0000)]
PR: 2188
Submitted By: Jaroslav Imrich <jaroslav.imrich@disig.sk>
Add "missing" functions to get and set prompt constructor.
Dr. Stephen Henson [Tue, 9 Mar 2010 17:08:39 +0000 (17:08 +0000)]
PR: 2186
Submitted By: "Joel Rabinovitch" <Joel.Rabinovitch@tecsys.com>
Detect aix64-gcc
Dr. Stephen Henson [Mon, 8 Mar 2010 23:47:57 +0000 (23:47 +0000)]
reserve a few more bits for future cipher modes
Dr. Stephen Henson [Sun, 7 Mar 2010 16:40:19 +0000 (16:40 +0000)]
The OID sanity check was incorrect. It should only disallow *leading* 0x80
values.
Dr. Stephen Henson [Sat, 6 Mar 2010 20:47:45 +0000 (20:47 +0000)]
don't add digest alias if signature algorithm is undefined
Dr. Stephen Henson [Fri, 5 Mar 2010 13:33:43 +0000 (13:33 +0000)]
Fix memory leak: free up ENGINE functional reference if digest is not
found in an ENGINE.
Dr. Stephen Henson [Wed, 3 Mar 2010 19:56:17 +0000 (19:56 +0000)]
PR: 2183
PR#1999 broke fork detection by assuming HAVE_FORK was set for all platforms.
Include original HAVE_FORK detection logic while allowing it to be
overridden on specific platforms with -DHAVE_FORK=1 or -DHAVE_FORK=0
Dr. Stephen Henson [Wed, 3 Mar 2010 15:41:00 +0000 (15:41 +0000)]
Submitted by: Tomas Hoger <thoger@redhat.com>
Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL
could be crashed if the relevant tables were not present (e.g. chrooted).
Dr. Stephen Henson [Wed, 3 Mar 2010 15:30:26 +0000 (15:30 +0000)]
don't mix definitions and code
Andy Polyakov [Tue, 2 Mar 2010 16:25:10 +0000 (16:25 +0000)]
Fix s390x-specific HOST_l2c|c2l [from HEAD].
Submitted by: Andreas Krebbel
Dr. Stephen Henson [Mon, 1 Mar 2010 23:54:34 +0000 (23:54 +0000)]
PR: 2178
Submitted by: "Kennedy, Brendan" <brendan.kennedy@intel.com>
Handle error codes correctly: cryptodev returns 0 for success whereas OpenSSL
returns 1.
Dr. Stephen Henson [Mon, 1 Mar 2010 14:22:02 +0000 (14:22 +0000)]
use supplied ENGINE in genrsa
Dr. Stephen Henson [Mon, 1 Mar 2010 03:01:56 +0000 (03:01 +0000)]
use correct prototype as in HEAD
Dr. Stephen Henson [Mon, 1 Mar 2010 01:52:47 +0000 (01:52 +0000)]
'typo'
Dr. Stephen Henson [Mon, 1 Mar 2010 01:19:36 +0000 (01:19 +0000)]
make USE_CRYPTODEV_DIGESTS work
Ben Laurie [Sun, 28 Feb 2010 13:38:16 +0000 (13:38 +0000)]
Fix warning.
Dr. Stephen Henson [Sun, 28 Feb 2010 00:24:24 +0000 (00:24 +0000)]
algorithms field has changed in 1.0.0 and later: update
Dr. Stephen Henson [Sat, 27 Feb 2010 23:04:10 +0000 (23:04 +0000)]
Add Kerberos fix which was in 0.9.8-stable but never committed to HEAD and
1.0.0. Original fix was on 2007-Mar-09 and had the log message: "Fix kerberos
ciphersuite bugs introduced with PR:1336."
Dr. Stephen Henson [Fri, 26 Feb 2010 14:41:48 +0000 (14:41 +0000)]
Revert CFB block length change. Despite what SP800-38a says the input to
CFB mode does *not* have to be a multiple of the block length and several
other specifications (e.g. PKCS#11) do not require this.
Dr. Stephen Henson [Fri, 26 Feb 2010 12:14:30 +0000 (12:14 +0000)]
oops, use correct date
Dr. Stephen Henson [Thu, 25 Feb 2010 18:21:20 +0000 (18:21 +0000)]
update FAQ, NEWS
Dr. Stephen Henson [Tue, 23 Feb 2010 14:09:22 +0000 (14:09 +0000)]
The meaning of the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY and
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT error codes were reversed in
the verify application documentation.
Bodo Möller [Tue, 23 Feb 2010 10:36:30 +0000 (10:36 +0000)]
Always check bn_wexpend() return values for failure (CVE-2009-3245).
(The CHANGES entry covers the change from PR #2111 as well, submitted by
Martin Olsson.)
Submitted by: Neel Mehta
Bodo Möller [Fri, 19 Feb 2010 18:26:23 +0000 (18:26 +0000)]
Fix X509_STORE locking
Dr. Stephen Henson [Thu, 18 Feb 2010 12:41:50 +0000 (12:41 +0000)]
clarify documentation
Dr. Stephen Henson [Wed, 17 Feb 2010 19:43:46 +0000 (19:43 +0000)]
OR default SSL_OP_LEGACY_SERVER_CONNECT so existing options are preserved
Dr. Stephen Henson [Wed, 17 Feb 2010 18:38:10 +0000 (18:38 +0000)]
Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as
initial connection to unpatched servers. There are no additional security
concerns in doing this as clients don't see renegotiation during an
attack anyway.
Dr. Stephen Henson [Wed, 17 Feb 2010 14:32:25 +0000 (14:32 +0000)]
PR: 2100
Submitted by: James Baker <jbaker@tableausoftware.com> et al.
Workaround for slow Heap32Next on some versions of Windows.
Dr. Stephen Henson [Tue, 16 Feb 2010 14:30:19 +0000 (14:30 +0000)]
Submitted by: Dmitry Ivanov <vonami@gmail.com>
Don't leave dangling pointers in GOST engine if calls fail.
Dr. Stephen Henson [Tue, 16 Feb 2010 14:20:40 +0000 (14:20 +0000)]
PR: 2171
Submitted by: Tomas Mraz <tmraz@redhat.com>
Since SSLv2 doesn't support renegotiation at all don't reject it if
legacy renegotiation isn't enabled.
Also can now use SSL2 compatible client hello because RFC5746 supports it.
Dr. Stephen Henson [Mon, 15 Feb 2010 19:40:30 +0000 (19:40 +0000)]
The "block length" for CFB mode was incorrectly coded as 1 all the time. It
should be the number of feedback bits expressed in bytes. For CFB1 mode set
this to 1 by rounding up to the nearest multiple of 8.
Dr. Stephen Henson [Mon, 15 Feb 2010 19:25:52 +0000 (19:25 +0000)]
Correct ECB mode EVP_CIPHER definition: IV length is 0
Dr. Stephen Henson [Mon, 15 Feb 2010 19:17:55 +0000 (19:17 +0000)]
add EVP_CIPH_FLAG_LENGTH_BITS from 0.9.8-stable
Dr. Stephen Henson [Mon, 15 Feb 2010 19:01:56 +0000 (19:01 +0000)]
PR: 2164
Submitted by: "Noszticzius, Istvan" <inoszticzius@rightnow.com>
Don't clear the output buffer: ciphers should correctly the same input
and output buffers.
Dr. Stephen Henson [Fri, 12 Feb 2010 21:59:57 +0000 (21:59 +0000)]
update references to new RI RFC
Dr. Stephen Henson [Fri, 12 Feb 2010 17:07:24 +0000 (17:07 +0000)]
PR: 2170
Submitted by: Magnus Lilja <lilja.magnus@gmail.com>
Make -c option in dgst work again.
Dr. Stephen Henson [Fri, 12 Feb 2010 17:02:13 +0000 (17:02 +0000)]
Make assembly language versions of OPENSSL_cleanse() accept zero length
parameter. Backport from HEAD, orginal by appro.
Dr. Stephen Henson [Tue, 9 Feb 2010 14:17:57 +0000 (14:17 +0000)]
Fix memory leak in ENGINE autoconfig code. Improve error logging.
Dr. Stephen Henson [Tue, 9 Feb 2010 14:13:00 +0000 (14:13 +0000)]
update year
Dr. Stephen Henson [Sun, 7 Feb 2010 13:54:54 +0000 (13:54 +0000)]
oops, use new value for new flag
Dr. Stephen Henson [Sun, 7 Feb 2010 13:47:08 +0000 (13:47 +0000)]
make update
Dr. Stephen Henson [Sun, 7 Feb 2010 13:41:23 +0000 (13:41 +0000)]
Add missing function EVP_CIPHER_CTX_copy(). Current code uses memcpy() to copy
an EVP_CIPHER_CTX structure which may have problems with external ENGINEs
who need to duplicate internal handles etc.
Dr. Stephen Henson [Wed, 3 Feb 2010 18:19:05 +0000 (18:19 +0000)]
don't assume 0x is at start of string
Dr. Stephen Henson [Tue, 2 Feb 2010 14:26:32 +0000 (14:26 +0000)]
tolerate broken CMS/PKCS7 implementations using signature OID instead of digest
Dr. Stephen Henson [Tue, 2 Feb 2010 13:36:05 +0000 (13:36 +0000)]
PR: 2161
Submitted by: Doug Goldstein <cardoe@gentoo.org>, Steve.
Make no-dsa, no-ecdsa and no-rsa compile again.
Dr. Stephen Henson [Mon, 1 Feb 2010 16:49:42 +0000 (16:49 +0000)]
PR: 2160
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Make session tickets work with DTLS.
Dr. Stephen Henson [Mon, 1 Feb 2010 12:44:11 +0000 (12:44 +0000)]
PR: 2159
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Typo in PR#1949 bug, oops!
Richard Levitte [Fri, 29 Jan 2010 12:07:50 +0000 (12:07 +0000)]
Typo.
Richard Levitte [Fri, 29 Jan 2010 12:02:54 +0000 (12:02 +0000)]
The previous take went wrong, try again.
Richard Levitte [Fri, 29 Jan 2010 11:44:40 +0000 (11:44 +0000)]
Architecture specific header files need special handling.
Richard Levitte [Fri, 29 Jan 2010 11:43:53 +0000 (11:43 +0000)]
If opensslconf.h and buildinf.h are to be in an architecture specific
directory, place it in the same tree as the other architecture
specific things.
Dr. Stephen Henson [Thu, 28 Jan 2010 17:52:18 +0000 (17:52 +0000)]
oops, revert more test code arghh!
Dr. Stephen Henson [Thu, 28 Jan 2010 17:50:23 +0000 (17:50 +0000)]
In engine_table_select() don't clear out entire error queue: just clear
out any we added using ERR_set_mark() and ERR_pop_to_mark() otherwise
errors from other sources (e.g. SSL library) can be wiped.
Dr. Stephen Henson [Wed, 27 Jan 2010 18:53:49 +0000 (18:53 +0000)]
reword RI description
Dr. Stephen Henson [Wed, 27 Jan 2010 17:50:20 +0000 (17:50 +0000)]
update documentation to reflect new renegotiation options
Dr. Stephen Henson [Wed, 27 Jan 2010 16:06:58 +0000 (16:06 +0000)]
Some shells print out the directory name if CDPATH is set breaking the
pod2man test. Use ./util instead to avoid this.
Dr. Stephen Henson [Wed, 27 Jan 2010 14:05:15 +0000 (14:05 +0000)]
typo
Dr. Stephen Henson [Wed, 27 Jan 2010 12:55:52 +0000 (12:55 +0000)]
PR: 2157
Submitted by: "Green, Paul" <Paul.Green@stratus.com>
Typo.
Richard Levitte [Wed, 27 Jan 2010 09:18:05 +0000 (09:18 +0000)]
Cosmetic changes, including changing a confusing example.
Richard Levitte [Wed, 27 Jan 2010 01:19:12 +0000 (01:19 +0000)]
Apparently, test/testtsa.com was only half done
Richard Levitte [Wed, 27 Jan 2010 01:18:26 +0000 (01:18 +0000)]
size_t doesn't compare less than zero...
Dr. Stephen Henson [Tue, 26 Jan 2010 19:48:10 +0000 (19:48 +0000)]
add CHANGES entry
Dr. Stephen Henson [Tue, 26 Jan 2010 19:46:30 +0000 (19:46 +0000)]
PR: 1949
Submitted by: steve@openssl.org
More robust fix and workaround for PR#1949. Don't try to work out if there
is any write pending data as this can be unreliable: always flush.
Dr. Stephen Henson [Tue, 26 Jan 2010 18:07:41 +0000 (18:07 +0000)]
PR: 2138
Submitted by: Kevin Regan <k.regan@f5.com>
Clear stat structure if -DPURIFY is set to avoid problems on some
platforms which include unitialised fields.
Dr. Stephen Henson [Tue, 26 Jan 2010 14:33:52 +0000 (14:33 +0000)]
Add flags functions which were added to 0.9.8 for fips but not 1.0.0 and
later.
Dr. Stephen Henson [Tue, 26 Jan 2010 13:58:49 +0000 (13:58 +0000)]
OPENSSL_isservice is now defined on all platforms not just WIN32
Dr. Stephen Henson [Tue, 26 Jan 2010 13:56:15 +0000 (13:56 +0000)]
oops
Dr. Stephen Henson [Tue, 26 Jan 2010 13:55:33 +0000 (13:55 +0000)]
export OPENSSL_isservice and make update
Dr. Stephen Henson [Tue, 26 Jan 2010 12:29:48 +0000 (12:29 +0000)]
Typo
Dr. Stephen Henson [Mon, 25 Jan 2010 16:07:51 +0000 (16:07 +0000)]
PR: 2149
Submitted by: Douglas Stebila <douglas@stebila.ca>
Fix wap OIDs.
Richard Levitte [Mon, 25 Jan 2010 00:22:52 +0000 (00:22 +0000)]
There's really no need to use $ENV::HOME
Richard Levitte [Mon, 25 Jan 2010 00:21:14 +0000 (00:21 +0000)]
Forgot to correct the definition of __arch in this file.
Submitted by Steven M. Schweda <sms@antinode.info>
Richard Levitte [Mon, 25 Jan 2010 00:20:32 +0000 (00:20 +0000)]
It seems like sslroot: needs to be defined for some tests to work.
Submitted by Steven M. Schweda <sms@antinode.info>
Richard Levitte [Mon, 25 Jan 2010 00:19:33 +0000 (00:19 +0000)]
Compile t1_reneg on VMS as well.
Submitted by Steven M. Schweda <sms@antinode.info>
Richard Levitte [Mon, 25 Jan 2010 00:18:31 +0000 (00:18 +0000)]
A few more macros for long symbols.
Submitted by Steven M. Schweda <sms@antinode.info>
Dr. Stephen Henson [Sun, 24 Jan 2010 16:57:38 +0000 (16:57 +0000)]
PR: 2153, 2125
Submitted by: steve@openssl.org
The original fix for PR#2125 broke compilation on some Unixware platforms:
revert and make conditional on VMS.
Dr. Stephen Henson [Sun, 24 Jan 2010 13:54:07 +0000 (13:54 +0000)]
The fix for PR#1949 unfortunately broke cases where the BIO_CTRL_WPENDING
ctrl is incorrectly implemented (e.g. some versions of Apache). As a workaround
call both BIO_CTRL_INFO and BIO_CTRL_WPENDING if it returns zero. This should
both address the original bug and retain compatibility with the old behaviour.