summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Prepare for 1.1.1-pre7 releaseOpenSSL_1_1_1-pre7Matt Caswell2018-05-292-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update copyright yearMatt Caswell2018-05-2992-93/+93
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6371)
* ECDSA_SIG: restore doc comments which were deleted accidentallyDr. Matthias St. Pierre2018-05-281-0/+2
| | | | | | | amends 0396401d1c3f Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6366)
* ECDSA_SIG: add simple getters for commonly used struct membersDr. Matthias St. Pierre2018-05-284-6/+36
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
* RSA: add simple getters for commonly used struct membersDr. Matthias St. Pierre2018-05-284-1/+77
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
* DSA: add simple getters for commonly used struct membersDr. Matthias St. Pierre2018-05-284-2/+49
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
* DH: fix: add simple getters for commonly used struct membersDr. Matthias St. Pierre2018-05-282-6/+10
| | | | | | | amends 6db7fadf0975 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
* util/libcrypto.num: fix symbol collision between 1.1.0 and masterDr. Matthias St. Pierre2018-05-271-4/+4
| | | | | | | | | | | | | In commit 6decf9436f7, fourteen public symbols were removed from util/libcrypto.num on the master branch and the following symbols renumbered. Unfortunately, the symbols `OCSP_resp_get0_signer` and `X509_get0_authority_key_id` were not adjusted accordingly on the OpenSSL_1_1_0-stable branch. This commit fixes the collision by doing a 'double swap'. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6278)
* Try to work around ubuntu gcc-5 ubsan build failureBernd Edlinger2018-05-261-10/+14
| | | | | | | [extended tests] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6360)
* Improve the example getpass() implementation to show an error returnNick Mathewson2018-05-261-6/+5
| | | | | | | | | Also, modernize the code, so that it isn't trying to store a size_t into an int, and then check the int's sign. :/ Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6271)
* Update documentation for PEM callback: error is now -1.Nick Mathewson2018-05-261-1/+1
| | | | | | | | | | | | | | | | In previous versions of OpenSSL, the documentation for PEM_read_* said: The callback B<must> return the number of characters in the passphrase or 0 if an error occurred. But since c82c3462267afdbbaa5, 0 is now treated as a non-error return value. Applications that want to indicate an error need to return -1 instead. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6271)
* Fix array bounds violation in ssl_session_dupBernd Edlinger2018-05-251-1/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6353)
* Add a sanity check on the length of pkeyutl inputsMatt Caswell2018-05-243-22/+41
| | | | | | | | | | When signing or verifying a file using pkeyutl the input is supposed to be a hash. Some algorithms sanity check the length of the input, while others don't and silently truncate. To avoid accidents we check that the length of the input looks sane. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6284)
* Revert "Support EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA"Matt Caswell2018-05-244-65/+20
| | | | | | | | | | | | This reverts commit a6f5b1163452a36da1c8378eab3f29ae234e5c7f. The EVP_PKEY_sign() function is intended for pre-hashed input which is not supported by our EdDSA implementation. See the discussion in PR 5880 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6284)
* Improve compatibility of point and curve checksMatt Caswell2018-05-248-27/+50
| | | | | | | | | | We check that the curve name associated with the point is the same as that for the curve. Fixes #6302 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6323)
* Save and restore the Windows error around TlsGetValue.David Benjamin2018-05-234-2/+76
| | | | | | | | | | | | | | TlsGetValue clears the last error even on success, so that callers may distinguish it successfully returning NULL or failing. This error-mangling behavior interferes with the caller's use of GetLastError. In particular SSL_get_error queries the error queue to determine whether the caller should look at the OS's errors. To avoid destroying state, save and restore the Windows error. Fixes #6299. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6316)
* Use OPENSSL_EC_EXPLICIT_CURVE constant.David Benjamin2018-05-231-1/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6314)
* Fix explicit EC curve encoding.David Benjamin2018-05-232-46/+102
| | | | | | | | | | | Per SEC 1, the curve coefficients must be padded up to size. See C.2's definition of Curve, C.1's definition of FieldElement, and 2.3.5's definition of how to encode the field elements in http://www.secg.org/sec1-v2.pdf. This comes up for P-521, where b needs a leading zero. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6314)
* Skip CN DNS name constraint checks when not neededViktor Dukhovni2018-05-235-30/+59
| | | | | | | | | | | | | Only check the CN against DNS name contraints if the `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` flag is not set, and either the certificate has no DNS subject alternative names or the `X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT` flag is set. Add pertinent documentation, and touch up some stale text about name checks and DANE. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Limit scope of CN name constraintsViktor Dukhovni2018-05-2315-209/+379
| | | | | | | | | | | | | | | Don't apply DNS name constraints to the subject CN when there's a least one DNS-ID subjectAlternativeName. Don't apply DNS name constraints to subject CN's that are sufficiently unlike DNS names. Checked name must have at least two labels, with all labels non-empty, no trailing '.' and all hyphens must be internal in each label. In addition to the usual LDH characters, we also allow "_", since some sites use these for hostnames despite all the standards. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Use the client app traffic secret for PHA Finished messageMatt Caswell2018-05-231-2/+13
| | | | | | | | | | | The TLSv1.3 spec requires us to use the client application traffic secret during generation of the Finished message following a post handshake authentication. Fixes #6263 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/6297)
* INSTALL: Provide better documentation for enable-ec_nistp_64_gcc_128Richard Levitte2018-05-231-2/+7
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6328)
* Better error code when lacking __SIZEOF_INT128__Richard Levitte2018-05-233-3/+3
| | | | | | | Fixes #6327 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6328)
* Fix no-ec, no-tls1_3 and no-tlsMatt Caswell2018-05-231-0/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6321)
* Enable SSL_MODE_AUTO_RETRY by defaultKurt Roeckx2018-05-225-9/+17
| | | | | | | | | | | | | Because TLS 1.3 sends more non-application data records some clients run into problems because they don't expect SSL_read() to return and set SSL_ERROR_WANT_READ after processing it. This can cause problems for clients that use blocking I/O and use select() to see if data is available. It can be cleared using SSL_CTX_clear_mode(). Reviewed-by: Matt Caswell <matt@openssl.org> GH: #6260
* Fix no-ec in combination with no-dhMatt Caswell2018-05-223-4/+22
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6321)
* ssl/ssl_txt: fix NULL-checkTilman Keskinöz2018-05-211-7/+7
| | | | | | | | | | | | NULL-check for cipher is redundant, instead check if cipher->name is NULL While here fix formatting of BIO_printf calls as suggested by Andy Polyakov. CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6282)
* apps/s_socket.c: address rare TLSProxy failures on Windows.Andy Polyakov2018-05-211-0/+18
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Check malloc failure via app_mallocRich Salz2018-05-211-1/+1
| | | | | | | Thanks to GitHUb user murugesandins for reporting this. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6322)
* Don't cache stateless tickets in TLSv1.3Matt Caswell2018-05-212-11/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | In TLSv1.2 and below we always cache new sessions by default on the server side in the internal cache (even when we're using session tickets). This is in order to support resumption from a session id. In TLSv1.3 there is no session id. It is only possible to resume using the ticket. Therefore, in the default case, there is no point in caching the session in the internal store. There is still a reason to call the external cache new session callback because applications may be using the callbacks just to know about when sessions are created (and not necessarily implementing a full cache). If the application also implements the remove session callback then we are forced to also store it in the internal cache so that we can create timeout events. Otherwise the external cache could just fill up indefinitely. This mostly addresses the issue described in #5628. That issue also proposes having an option to not create full stateless tickets when using the internal cache. That aspect hasn't been addressed yet. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/6293)
* Fix undefined behaviour in X509_NAME_cmp()Matt Caswell2018-05-211-1/+1
| | | | | | | | | If the lengths of both names is 0 then don't attempt to do a memcmp. Issue reported by Simon Friedberger, Robert Merget and Juraj Somorovsky. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6291)
* Windows: don't install __DECC_*.HRichard Levitte2018-05-202-3/+10
| | | | | | | | | | This adds the possibility to exclude files by regexp in util/copy.pl Partial fix for #3254 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6303)
* Quiet pod2html warningsRichard Levitte2018-05-201-1/+1
| | | | | | | | | | | | | | --quiet stops warnings of this sort: Cannot find "BIO_read_ex" in podpath: cannot find suitable replacement path, cannot resolve link We know what causes these warnings, it's perfectly innocuous, and we don't want to hear it any more. Partial fix for #3254 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6304)
* Fix no-srtp build warningsTodd Short2018-05-202-0/+8
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6255)
* Restore check of |*xn| against |name| in X509_NAME_setRichard Levitte2018-05-201-0/+2
| | | | | | | | | | | | | | | | | A previous change of this function introduced a fragility when the destination happens to be the same as the source. Such alias isn't recommended, but could still happen, for example in this kind of code: X509_NAME *subject = X509_get_issuer_name(x); /* ... some code passes ... */ X509_set_issuer_name(x, subject); Fixes #4710 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6280)
* Allow the ca application to use EdDSAMatt Caswell2018-05-183-11/+16
| | | | | | | | | | | Using the ca application to sign certificates with EdDSA failed because it is not possible to set the digest to "null". This adds the capability and updates the documentation accordingly. Fixes #6201 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6286)
* DH: add some basic tests (and comments)Dr. Matthias St. Pierre2018-05-181-0/+85
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6273)
* DH: add simple getters for commonly used DH struct membersDr. Matthias St. Pierre2018-05-184-3/+52
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6273)
* Make BN_GF2m_mod_arr more constant timeMatt Caswell2018-05-171-15/+17
| | | | | | | | | | | | | | | | | Experiments have shown that the lookup table used by BN_GF2m_mod_arr introduces sufficient timing signal to recover the private key for an attacker with access to cache timing information on the victim's host. This only affects binary curves (which are less frequently used). No CVE is considered necessary for this issue. The fix is to replace the lookup table with an on-the-fly calculation of the value from the table instead, which can be performed in constant time. Thanks to Youngjoo Shin for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6270)
* Improve testing of tickets with post-handshake authMatt Caswell2018-05-171-18/+51
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5227)
* Add documentation for the ability to control the number of ticketsMatt Caswell2018-05-171-0/+68
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5227)
* Change the default number of NewSessionTickets we send to 2Matt Caswell2018-05-177-54/+185
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5227)
* Allow configuation of the number of TLSv1.3 session tickets via SSL_CONFMatt Caswell2018-05-174-4/+25
| | | | | | | | Also allows the apps to set it. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5227)
* Enable the ability to set the number of TLSv1.3 session tickets sentMatt Caswell2018-05-175-18/+93
| | | | | | | | | | | | We send a session ticket automatically in TLSv1.3 at the end of the handshake. This commit provides the ability to set how many tickets should be sent. By default this is one. Fixes #4978 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5227)
* Add a note on CHANGES and NEWS in CONTRIBUTINGRichard Levitte2018-05-171-0/+17
| | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6249)
* When producing man-pages, ensure NAME section is one line onlyRichard Levitte2018-05-161-0/+26
| | | | | | | | | | | | | | There are *roff parsers that are strict about the NAME section being one line only. The man(7) on Debian GNU/Linux suggests that this is appropriate, so we compensate our multi-line NAME sections by fixing the *roff output. Noted by Eric S. Raymond Related to #6264 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6268)
* NOTES.ANDROID: fix typo in build notesGregor Jasny2018-05-151-1/+1
| | | | | | | | | CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6244)
* windows-makefile.tmpl: delete export library prior link.Andy Polyakov2018-05-151-0/+1
| | | | | | | | | LINK can outsmart itself and choose to not update export .lib upon corresponding .dll re-link. Since dependency is between .lib and all .obj-s, re-compilation of any .obj makes NMAKE relink .dll and all .exe-s over and over... Reviewed-by: Rich Salz <rsalz@openssl.org>
* Suport TLSv1.3 draft 28Matt Caswell2018-05-158-14/+50
| | | | | | | | | Also retains support for drafts 27 and 26 Fixes #6257 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6258)
* Fix no-tls1_2Matt Caswell2018-05-141-2/+2
| | | | | | | Also fixes no-tls1_2-method, no-tls1_3, no-tls, no-ec Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6253)
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-01 21:49:30 +0000