oweals/openssl.git
14 years agoFix UPLINK typo [from HEAD].
Andy Polyakov [Mon, 15 Mar 2010 22:27:32 +0000 (22:27 +0000)]
Fix UPLINK typo [from HEAD].

14 years agoworkaround for missing definition in some headers
Dr. Stephen Henson [Mon, 15 Mar 2010 13:12:00 +0000 (13:12 +0000)]
workaround for missing definition in some headers

14 years agoPR: 2192
Dr. Stephen Henson [Fri, 12 Mar 2010 12:48:56 +0000 (12:48 +0000)]
PR: 2192
Submitted By: Jaroslav Imrich <jaroslav.imrich@disig.sk>

The prompt_info and wrong_info parameters can be empty strings which
can produce confusing prompts. Treat empty string same as NULL.

14 years agomissing goto meant signature was never printed out
Dr. Stephen Henson [Fri, 12 Mar 2010 12:07:16 +0000 (12:07 +0000)]
missing goto meant signature was never printed out

14 years agodon't leave bogus errors in the queue
Dr. Stephen Henson [Wed, 10 Mar 2010 13:48:35 +0000 (13:48 +0000)]
don't leave bogus errors in the queue

14 years agoPR: 2186
Dr. Stephen Henson [Tue, 9 Mar 2010 17:08:24 +0000 (17:08 +0000)]
PR: 2186
Submitted By: "Joel Rabinovitch" <Joel.Rabinovitch@tecsys.com>

Detect aix64-gcc

14 years agoThe OID sanity check was incorrect. It should only disallow *leading* 0x80
Dr. Stephen Henson [Sun, 7 Mar 2010 16:40:31 +0000 (16:40 +0000)]
The OID sanity check was incorrect. It should only disallow *leading* 0x80
values.

14 years agodon't add digest alias if signature algorithm is undefined
Dr. Stephen Henson [Sat, 6 Mar 2010 20:52:33 +0000 (20:52 +0000)]
don't add digest alias if signature algorithm is undefined

14 years agoFix memory leak: free up ENGINE functional reference if digest is not
Dr. Stephen Henson [Fri, 5 Mar 2010 13:35:06 +0000 (13:35 +0000)]
Fix memory leak: free up ENGINE functional reference if digest is not
found in an ENGINE.

14 years agoPR: 2183
Dr. Stephen Henson [Wed, 3 Mar 2010 19:56:00 +0000 (19:56 +0000)]
PR: 2183

PR#1999 broke fork detection by assuming HAVE_FORK was set for all platforms.
Include original HAVE_FORK detection logic while allowing it to be
overridden on specific platforms with -DHAVE_FORK=1 or -DHAVE_FORK=0

14 years agoSubmitted by: Tomas Hoger <thoger@redhat.com>
Dr. Stephen Henson [Wed, 3 Mar 2010 15:34:11 +0000 (15:34 +0000)]
Submitted by: Tomas Hoger <thoger@redhat.com>

Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL
could be crashed if the relevant tables were not present (e.g. chrooted).

14 years agodon't mix definitions and code
Dr. Stephen Henson [Wed, 3 Mar 2010 15:30:05 +0000 (15:30 +0000)]
don't mix definitions and code

14 years agoFix s390x-specific HOST_l2c|c2l [from HEAD].
Andy Polyakov [Tue, 2 Mar 2010 16:26:13 +0000 (16:26 +0000)]
Fix s390x-specific HOST_l2c|c2l [from HEAD].

Submitted by: Andreas Krebbel

14 years agoPR: 2178
Dr. Stephen Henson [Mon, 1 Mar 2010 23:54:19 +0000 (23:54 +0000)]
PR: 2178
Submitted by: "Kennedy, Brendan" <brendan.kennedy@intel.com>

Handle error codes correctly: cryptodev returns 0 for success whereas OpenSSL
returns 1.

14 years agoload cryptodev if HAVE_CRYPTODEV is set too
Dr. Stephen Henson [Mon, 1 Mar 2010 00:30:11 +0000 (00:30 +0000)]
load cryptodev if HAVE_CRYPTODEV is set too

14 years agoFix warnings.
Ben Laurie [Sun, 28 Feb 2010 13:37:15 +0000 (13:37 +0000)]
Fix warnings.

14 years agoquote HOSTCC in case it isn't defined
Dr. Stephen Henson [Fri, 26 Feb 2010 19:56:10 +0000 (19:56 +0000)]
quote HOSTCC in case it isn't defined

14 years agoRevert CFB block length change. Despite what SP800-38a says the input to
Dr. Stephen Henson [Fri, 26 Feb 2010 14:41:38 +0000 (14:41 +0000)]
Revert CFB block length change. Despite what SP800-38a says the input to
CFB mode does *not* have to be a multiple of the block length and several
other specifications (e.g. PKCS#11) do not require this.

14 years agoChange versions for 0.9.8n-dev
Dr. Stephen Henson [Fri, 26 Feb 2010 14:34:24 +0000 (14:34 +0000)]
Change versions for 0.9.8n-dev

14 years agoPrepare for 0.9.8m release OpenSSL_0_9_8m
Dr. Stephen Henson [Thu, 25 Feb 2010 17:18:23 +0000 (17:18 +0000)]
Prepare for 0.9.8m release

14 years agoSince crypto-lib.com is built to be executed in the crypto/ directory,
Richard Levitte [Wed, 24 Feb 2010 01:20:04 +0000 (01:20 +0000)]
Since crypto-lib.com is built to be executed in the crypto/ directory,
there's no need to specify that directory in the include path.

14 years agoThe meaning of the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY and
Dr. Stephen Henson [Tue, 23 Feb 2010 14:09:32 +0000 (14:09 +0000)]
The meaning of the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY and
X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT error codes were reversed in
the verify application documentation.

14 years agoAlways check bn_wexpend() return values for failure (CVE-2009-3245).
Bodo Möller [Tue, 23 Feb 2010 10:36:41 +0000 (10:36 +0000)]
Always check bn_wexpend() return values for failure (CVE-2009-3245).

(The CHANGES entry covers the change from PR #2111 as well, submitted by
Martin Olsson.)

Submitted by: Neel Mehta

14 years agoApply changes from the 1.0.0 branch.
Richard Levitte [Tue, 23 Feb 2010 07:51:39 +0000 (07:51 +0000)]
Apply changes from the 1.0.0 branch.

14 years agoInclude [.CRYPTO.<ARCH>] instead of just [.<ARCH>]
Richard Levitte [Tue, 23 Feb 2010 07:50:54 +0000 (07:50 +0000)]
Include [.CRYPTO.<ARCH>] instead of just [.<ARCH>]

14 years agoIn some environments, we need to defined sslroot locally.
Richard Levitte [Mon, 22 Feb 2010 07:05:50 +0000 (07:05 +0000)]
In some environments, we need to defined sslroot locally.

14 years agoAdd t1_reneg to the VMS build.
Richard Levitte [Mon, 22 Feb 2010 07:05:24 +0000 (07:05 +0000)]
Add t1_reneg to the VMS build.
Hack the symbols with long names.

14 years agoFix X509_STORE locking
Bodo Möller [Fri, 19 Feb 2010 18:25:39 +0000 (18:25 +0000)]
Fix X509_STORE locking

14 years agoclarify documentation
Dr. Stephen Henson [Thu, 18 Feb 2010 12:42:03 +0000 (12:42 +0000)]
clarify documentation

14 years agoOR default SSL_OP_LEGACY_SERVER_CONNECT so existing options are preserved
Dr. Stephen Henson [Wed, 17 Feb 2010 19:43:08 +0000 (19:43 +0000)]
OR default SSL_OP_LEGACY_SERVER_CONNECT so existing options are preserved

14 years agoAllow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as
Dr. Stephen Henson [Wed, 17 Feb 2010 18:37:47 +0000 (18:37 +0000)]
Allow renegotiation if SSL_OP_LEGACY_SERVER_CONNECT is set as well as
initial connection to unpatched servers. There are no additional security
concerns in doing this as clients don't see renegotiation during an
attack anyway.

14 years agoPR: 2100
Dr. Stephen Henson [Wed, 17 Feb 2010 14:32:01 +0000 (14:32 +0000)]
PR: 2100
Submitted by: James Baker <jbaker@tableausoftware.com> et al.

Workaround for slow Heap32Next on some versions of Windows.

14 years agoPR: 2171
Dr. Stephen Henson [Tue, 16 Feb 2010 14:19:42 +0000 (14:19 +0000)]
PR: 2171
Submitted by: Tomas Mraz <tmraz@redhat.com>

Since SSLv2 doesn't support renegotiation at all don't reject it if
legacy renegotiation isn't enabled.

Also can now use SSL2 compatible client hello because RFC5746 supports it.

14 years agoThe "block length" for CFB mode was incorrectly coded as 1 all the time. It
Dr. Stephen Henson [Mon, 15 Feb 2010 19:40:45 +0000 (19:40 +0000)]
The "block length" for CFB mode was incorrectly coded as 1 all the time. It
should be the number of feedback bits expressed in bytes. For CFB1 mode set
this to 1 by rounding up to the nearest multiple of 8.

14 years agoCorrect ECB mode EVP_CIPHER definition: IV length is 0
Dr. Stephen Henson [Mon, 15 Feb 2010 19:25:37 +0000 (19:25 +0000)]
Correct ECB mode EVP_CIPHER definition: IV length is 0

14 years agoPR: 2164
Dr. Stephen Henson [Mon, 15 Feb 2010 19:02:53 +0000 (19:02 +0000)]
PR: 2164
Submitted by: "Noszticzius, Istvan" <inoszticzius@rightnow.com>

Don't clear the output buffer: ciphers should correctly the same input
and output buffers.

14 years agoupdate references to new RI RFC
Dr. Stephen Henson [Fri, 12 Feb 2010 22:02:07 +0000 (22:02 +0000)]
update references to new RI RFC

14 years agoFix memory leak in ENGINE autoconfig code. Improve error logging.
Dr. Stephen Henson [Tue, 9 Feb 2010 14:18:15 +0000 (14:18 +0000)]
Fix memory leak in ENGINE autoconfig code. Improve error logging.

14 years agoupdate year
Dr. Stephen Henson [Tue, 9 Feb 2010 14:13:30 +0000 (14:13 +0000)]
update year

14 years agoOnly use bufferoverflowu.lib when needed
Dr. Stephen Henson [Thu, 4 Feb 2010 01:10:24 +0000 (01:10 +0000)]
Only use bufferoverflowu.lib when needed

14 years agotolerate broken CMS/PKCS7 implementations using signature OID instead of digest
Dr. Stephen Henson [Tue, 2 Feb 2010 14:19:54 +0000 (14:19 +0000)]
tolerate broken CMS/PKCS7 implementations using signature OID instead of digest

14 years agomake no-rsa no-dsa compile again
Dr. Stephen Henson [Tue, 2 Feb 2010 14:03:07 +0000 (14:03 +0000)]
make no-rsa no-dsa compile again

14 years agoPR: 2160
Dr. Stephen Henson [Mon, 1 Feb 2010 16:48:40 +0000 (16:48 +0000)]
PR: 2160
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Make session tickets work with DTLS.

14 years agoPR: 2159
Dr. Stephen Henson [Mon, 1 Feb 2010 12:44:21 +0000 (12:44 +0000)]
PR: 2159
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Typo in PR#1949 bug, oops!

14 years agoIn engine_table_select() don't clear out entire error queue: just clear
Dr. Stephen Henson [Thu, 28 Jan 2010 17:53:11 +0000 (17:53 +0000)]
In engine_table_select() don't clear out entire error queue: just clear
out any we added using ERR_set_mark() and ERR_pop_to_mark() otherwise
errors from other sources (e.g. SSL library) can be wiped.

14 years agoreword RI description
Dr. Stephen Henson [Wed, 27 Jan 2010 18:53:59 +0000 (18:53 +0000)]
reword RI description

14 years agoupdate documentation to reflect new renegotiation options
Dr. Stephen Henson [Wed, 27 Jan 2010 17:50:47 +0000 (17:50 +0000)]
update documentation to reflect new renegotiation options

14 years agoSome shells print out the directory name if CDPATH is set breaking the
Dr. Stephen Henson [Wed, 27 Jan 2010 16:06:36 +0000 (16:06 +0000)]
Some shells print out the directory name if CDPATH is set breaking the
pod2man test. Use ./util instead to avoid this.

14 years agotypo
Dr. Stephen Henson [Wed, 27 Jan 2010 14:04:51 +0000 (14:04 +0000)]
typo

14 years agostop warnings in fips_test_suite application
Dr. Stephen Henson [Wed, 27 Jan 2010 14:03:26 +0000 (14:03 +0000)]
stop warnings in fips_test_suite application

14 years agostop missing prototype warnings
Dr. Stephen Henson [Wed, 27 Jan 2010 13:32:31 +0000 (13:32 +0000)]
stop missing prototype warnings

14 years agoeliminate some warnings in fips build
Dr. Stephen Henson [Wed, 27 Jan 2010 13:21:34 +0000 (13:21 +0000)]
eliminate some warnings in fips build

14 years agoBypass algorithm blocking with TLS MD5+SHA1 signature in FIPS mode by
Dr. Stephen Henson [Wed, 27 Jan 2010 00:51:24 +0000 (00:51 +0000)]
Bypass algorithm blocking with TLS MD5+SHA1 signature in FIPS mode by
calling underlying method directly.

14 years agoPR: 1949
Dr. Stephen Henson [Tue, 26 Jan 2010 19:40:36 +0000 (19:40 +0000)]
PR: 1949
Submitted by: steve@openssl.org

More robust fix and workaround for PR#1949. Don't try to work out if there
is any write pending data as this can be unreliable: always flush.

14 years agoPR: 2138
Dr. Stephen Henson [Tue, 26 Jan 2010 18:08:42 +0000 (18:08 +0000)]
PR: 2138
Submitted by: Kevin Regan <k.regan@f5.com>

Clear stat structure if -DPURIFY is set to avoid problems on some
platforms which include unitialised fields.

14 years agoFix VC++ warning (change had already been made to other branches).
Dr. Stephen Henson [Tue, 26 Jan 2010 13:24:08 +0000 (13:24 +0000)]
Fix VC++ warning (change had already been made to other branches).

14 years agoTypo
Dr. Stephen Henson [Tue, 26 Jan 2010 12:29:32 +0000 (12:29 +0000)]
Typo

14 years agoUpdate OID table too.
Dr. Stephen Henson [Mon, 25 Jan 2010 16:08:52 +0000 (16:08 +0000)]
Update OID table too.

14 years agoPR: 2149
Dr. Stephen Henson [Mon, 25 Jan 2010 16:08:01 +0000 (16:08 +0000)]
PR: 2149
Submitted by: Douglas Stebila <douglas@stebila.ca>

Fix wap OIDs.

14 years agooops revert test code from previous commit
Dr. Stephen Henson [Sun, 24 Jan 2010 13:52:38 +0000 (13:52 +0000)]
oops revert test code from previous commit

14 years agoThe fix for PR#1949 unfortunately broke cases where the BIO_CTRL_WPENDING
Dr. Stephen Henson [Sun, 24 Jan 2010 13:50:57 +0000 (13:50 +0000)]
The fix for PR#1949 unfortunately broke cases where the BIO_CTRL_WPENDING
ctrl is incorrectly implemented (e.g. some versions of Apache). As a workaround
call both BIO_CTRL_INFO and BIO_CTRL_WPENDING if it returns zero. This should
both address the original bug and retain compatibility with the old behaviour.

14 years agoIf legacy renegotiation is not permitted then send a fatal alert if a patched
Dr. Stephen Henson [Fri, 22 Jan 2010 18:49:43 +0000 (18:49 +0000)]
If legacy renegotiation is not permitted then send a fatal alert if a patched
server attempts to renegotiate with an unpatched client.

14 years agochange versions back to 0.9.8m-dev
Dr. Stephen Henson [Wed, 20 Jan 2010 18:22:04 +0000 (18:22 +0000)]
change versions back to 0.9.8m-dev

14 years agoprepare for release OpenSSL_0_9_8m-beta1
Dr. Stephen Henson [Wed, 20 Jan 2010 17:26:02 +0000 (17:26 +0000)]
prepare for release

14 years agoupdate TABLE
Dr. Stephen Henson [Wed, 20 Jan 2010 17:16:52 +0000 (17:16 +0000)]
update TABLE

14 years agomake update
Dr. Stephen Henson [Wed, 20 Jan 2010 16:35:30 +0000 (16:35 +0000)]
make update

14 years agoSupport -L options in VC++ link.
Dr. Stephen Henson [Wed, 20 Jan 2010 14:04:29 +0000 (14:04 +0000)]
Support -L options in VC++ link.

14 years agorand_win.c: handel GetTickCount wrap-around [from HEAD].
Andy Polyakov [Tue, 19 Jan 2010 21:45:45 +0000 (21:45 +0000)]
rand_win.c: handel GetTickCount wrap-around [from HEAD].

14 years agox86_64-xlate.pl: refine sign extension logic when handling lea [from HEAD].
Andy Polyakov [Tue, 19 Jan 2010 21:45:16 +0000 (21:45 +0000)]
x86_64-xlate.pl: refine sign extension logic when handling lea [from HEAD].
PR: 2094,2095

14 years agorevert patch
Dr. Stephen Henson [Tue, 19 Jan 2010 19:10:53 +0000 (19:10 +0000)]
revert patch

14 years agoPR: 2144
Dr. Stephen Henson [Tue, 19 Jan 2010 19:10:03 +0000 (19:10 +0000)]
PR: 2144
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Better fix for PR#2144

14 years agoValgrind fix to aes-x86_64.pl in 0.9.8. For reference, newer aes-x86_64.pl
Andy Polyakov [Sun, 17 Jan 2010 19:43:49 +0000 (19:43 +0000)]
Valgrind fix to aes-x86_64.pl in 0.9.8. For reference, newer aes-x86_64.pl
don't suffer from the problem after Win64 SEH support was added.
PR: 2075
Submitted by: Peter Klotz

14 years agoPR: 2144
Dr. Stephen Henson [Sat, 16 Jan 2010 19:45:46 +0000 (19:45 +0000)]
PR: 2144
Submitted by: steve@openssl.org

Fix DTLS connection so new_session is reset if we read second client hello:
new_session is used to detect renegotiation.

14 years agoPR: 2133
Dr. Stephen Henson [Sat, 16 Jan 2010 19:18:31 +0000 (19:18 +0000)]
PR: 2133
Submitted by: steve@openssl.org

Add missing DTLS state strings.

14 years agoAdd strings for DTLS protocol versions
Dr. Stephen Henson [Sat, 16 Jan 2010 19:02:43 +0000 (19:02 +0000)]
Add strings for DTLS protocol versions

14 years agoPR: 1618
Dr. Stephen Henson [Thu, 14 Jan 2010 17:44:46 +0000 (17:44 +0000)]
PR: 1618
Submitted by: steve@openssl.org

Fix bug in 0.9.8-stable time handling in ca.c . NB: this only handles cases
where times are not being checked or printed properly. Issues relating to
time_t becoming negative or wrapping around are *NOT* addressed. OpenSSL
1.0.0 and later does fix these issues by using its own time routines.

14 years agoFix version handling so it can cope with a major version >3.
Dr. Stephen Henson [Wed, 13 Jan 2010 19:08:45 +0000 (19:08 +0000)]
Fix version handling so it can cope with a major version >3.

Although it will be many years before TLS v2.0 or later appears old versions
of servers have a habit of hanging around for a considerable time so best
if we handle this properly now.

14 years agoModify compression code so it avoids using ex_data free functions. This
Dr. Stephen Henson [Wed, 13 Jan 2010 18:45:03 +0000 (18:45 +0000)]
Modify compression code so it avoids using ex_data free functions. This
stops applications that call CRYPTO_free_all_ex_data() prematurely leaking
memory.

14 years agoSimplify RI+SCSV logic:
Dr. Stephen Henson [Thu, 7 Jan 2010 19:09:32 +0000 (19:09 +0000)]
Simplify RI+SCSV logic:

1. Send SCSV is not renegotiating, never empty RI.
2. Send RI if renegotiating.

14 years agox86_64-xlate.pl: new gas requires sign extention in lea instruction
Andy Polyakov [Thu, 7 Jan 2010 11:22:25 +0000 (11:22 +0000)]
x86_64-xlate.pl: new gas requires sign extention in lea instruction
[from HEAD].
PR: 2094,2095

14 years agoutil/pl/VC-32.pl: bufferoverflowu.lib only when actually needed [from HEAD].
Andy Polyakov [Thu, 7 Jan 2010 11:04:49 +0000 (11:04 +0000)]
util/pl/VC-32.pl: bufferoverflowu.lib only when actually needed [from HEAD].
PR: 2086

14 years agocorrect error codes
Dr. Stephen Henson [Wed, 6 Jan 2010 18:02:07 +0000 (18:02 +0000)]
correct error codes

14 years agoUpdates to conform with draft-ietf-tls-renegotiation-03.txt:
Dr. Stephen Henson [Wed, 6 Jan 2010 17:59:41 +0000 (17:59 +0000)]
Updates to conform with draft-ietf-tls-renegotiation-03.txt:

1. Add provisional SCSV value.
2. Don't send SCSV and RI at same time.
3. Fatal error is SCSV received when renegotiating.

14 years agoTypo
Dr. Stephen Henson [Tue, 5 Jan 2010 17:50:12 +0000 (17:50 +0000)]
Typo

14 years agoPR: 2132
Dr. Stephen Henson [Tue, 5 Jan 2010 17:33:20 +0000 (17:33 +0000)]
PR: 2132
Submitted by: steve

Fix bundled pod2man.pl to handle alternative comment formats.

14 years agoUpdate RI to match latest spec.
Dr. Stephen Henson [Sun, 27 Dec 2009 23:03:40 +0000 (23:03 +0000)]
Update RI to match latest spec.

MCSV is now called SCSV.

Don't send SCSV if renegotiating.

Also note if RI is empty in debug messages.

14 years agoTraditional Yuletide commit ;-)
Dr. Stephen Henson [Fri, 25 Dec 2009 14:11:18 +0000 (14:11 +0000)]
Traditional Yuletide commit ;-)

Add Triple DES CFB1 and CFB8 to algorithm list and NID translation.

14 years agoConstify crypto/cast.
Bodo Möller [Tue, 22 Dec 2009 11:45:57 +0000 (11:45 +0000)]
Constify crypto/cast.

14 years agoConstify crypto/cast.
Bodo Möller [Tue, 22 Dec 2009 10:59:03 +0000 (10:59 +0000)]
Constify crypto/cast.

14 years agoOoops, engage ENGINE initialisation code correctly in FIPS builds.
Dr. Stephen Henson [Thu, 17 Dec 2009 16:38:18 +0000 (16:38 +0000)]
Ooops, engage ENGINE initialisation code correctly in FIPS builds.

14 years agoAlert to use is now defined in spec: update code
Dr. Stephen Henson [Thu, 17 Dec 2009 15:42:25 +0000 (15:42 +0000)]
Alert to use is now defined in spec: update code

14 years agoNew option to enable/disable connection to unpatched servers
Dr. Stephen Henson [Wed, 16 Dec 2009 20:34:20 +0000 (20:34 +0000)]
New option to enable/disable connection to unpatched servers

14 years agoadd another missed case
Dr. Stephen Henson [Mon, 14 Dec 2009 01:32:47 +0000 (01:32 +0000)]
add another missed case

14 years agosimplify RI error code and catch extra error case ignored before
Dr. Stephen Henson [Mon, 14 Dec 2009 01:28:51 +0000 (01:28 +0000)]
simplify RI error code and catch extra error case ignored before

14 years agoAllow initial connection (but no renegoriation) to servers which don't support
Dr. Stephen Henson [Mon, 14 Dec 2009 01:09:01 +0000 (01:09 +0000)]
Allow initial connection (but no renegoriation) to servers which don't support
RI.

14 years agoMissing newline.
Ben Laurie [Sat, 12 Dec 2009 11:10:25 +0000 (11:10 +0000)]
Missing newline.

14 years agoMove SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION out of SSL_OP_ALL
Dr. Stephen Henson [Fri, 11 Dec 2009 00:22:12 +0000 (00:22 +0000)]
Move SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION out of SSL_OP_ALL

14 years agoclarify docs
Dr. Stephen Henson [Wed, 9 Dec 2009 18:17:21 +0000 (18:17 +0000)]
clarify docs

14 years agoDocument option clearning functions.
Dr. Stephen Henson [Wed, 9 Dec 2009 18:01:07 +0000 (18:01 +0000)]
Document option clearning functions.

Initial secure renegotiation documentation.

14 years agoPR: 2124
Dr. Stephen Henson [Wed, 9 Dec 2009 13:41:50 +0000 (13:41 +0000)]
PR: 2124
Submitted by: Jan Pechanec <Jan.Pechanec@Sun.COM>

Check for memory allocation failures.