summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* RT3999: Remove sub-component version stringsRich Salz2015-08-1037-70/+0
| | | | | | Especially since after the #ifdef cleanups this is not useful. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix build break.Rich Salz2015-08-102-2/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Find the right indent on *BSD.Ben Laurie2015-08-101-3/+6
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* GH357: Update ocsp.cbluelineXY2015-08-081-0/+13
| | | | | | | Add Host Header in OCSP query if no host header is set via -header Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Ben Laurie <ben@openssl.org>
* RT3998: fix X509_check_host.pod release to 1.0.2David Woodhouse2015-08-081-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Ben Laurie <ben@openssl.org>
* Fix clang uninitialized variable warning.Adam Eijdenberg2015-08-061-1/+0
| | | | | | | | We could just initialize it, but to be consistent with the rest of the file it seemed to make more sense to just drop. Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Revert "Fix uninitalised warning."Matt Caswell2015-08-061-1/+1
| | | | | | | | | This reverts commit 704563f04a8401781b359906c1f88a30e12af69c. Reverting in favour of the next commit which removes the underlying cause of the warning. Reviewed-by: Ben Laurie <ben@openssl.org>
* Fix uninitalised warning.Ben Laurie2015-08-061-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT3990: Fix #include path.Anton Blanchard2015-08-051-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Change error reason to match previous behaviour.Adam Eijdenberg2015-08-041-1/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix unhandled error condition in sslv2 client hello parsing.Adam Eijdenberg2015-08-041-0/+3
| | | | | | | | | --strict-warnings started showing warnings for this today... Surely an error should be raised if these reads fail? Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix SRTP s_client/s_server optionsMatt Caswell2015-08-042-2/+2
| | | | | | | | The -use_srtp s_client/s_server option is supposed to take a colon separated string as an argument. In master this was incorrectly set to expect a filename. Reviewed-by: Rich Salz <rsalz@openssl.org>
* PACKETise NextProtoMatt Caswell2015-08-041-19/+24
| | | | | | Change NextProto message processing to use the PACKET API. Reviewed-by: Stephen Henson <steve@openssl.org>
* PACKETise CertificateVerify processingMatt Caswell2015-08-041-17/+30
| | | | | | Modify CertificateVerify processing to use the new PACKET API. Reviewed-by: Stephen Henson <steve@openssl.org>
* PACKETise ClientCertificate processingMatt Caswell2015-08-041-13/+20
| | | | | | Use the PACKET API for processing ClientCertificate messages Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix a bug in the new PACKET implementationMatt Caswell2015-08-042-32/+33
| | | | | | | Some of the PACKET functions were returning incorrect data. An unfortunate choice of test data in the unit test was masking the failure. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix warning when compiling with no-ec2mMatt Caswell2015-08-031-4/+8
| | | | | | | EC_KEY_set_public_key_affine_coordinates was using some variables that only apply if OPENSSL_NO_EC2M is not defined. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix make errors for the CCS changesMatt Caswell2015-08-032-2/+2
| | | | | | | The move of CCS into the state machine was causing make errors to fail. This fixes it. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix ssl3_read_bytes handshake fragment bugMatt Caswell2015-08-031-0/+4
| | | | | | | | | The move of CCS into the state machine introduced a bug in ssl3_read_bytes. The value of |recvd_type| was not being set if we are satisfying the request from handshake fragment storage. This can occur, for example, with renegotiation and causes the handshake to fail. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move DTLS CCS processing into the state machineMatt Caswell2015-08-036-92/+129
| | | | | | | Continuing on from the previous commit this moves the processing of DTLS CCS messages out of the record layer and into the state machine. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move TLS CCS processing into the state machineMatt Caswell2015-08-0312-142/+174
| | | | | | | | | | | | | | | | | | | | | The handling of incoming CCS records is a little strange. Since CCS is not a handshake message it is handled differently to normal handshake messages. Unfortunately whilst technically it is not a handhshake message the reality is that it must be processed in accordance with the state of the handshake. Currently CCS records are processed entirely within the record layer. In order to ensure that it is handled in accordance with the handshake state a flag is used to indicate that it is an acceptable time to receive a CCS. Previously this flag did not exist (see CVE-2014-0224), but the flag should only really be considered a workaround for the problem that CCS is not visible to the state machine. Outgoing CCS messages are already handled within the state machine. This patch makes CCS visible to the TLS state machine. A separate commit will handle DTLS. Reviewed-by: Tim Hudson <tjh@openssl.org>
* PACKETise ClientHello processingMatt Caswell2015-08-036-336/+344
| | | | | | | Uses the new PACKET code to process the incoming ClientHello including all extensions etc. Reviewed-by: Tim Hudson <tjh@openssl.org>
* PACKET unit testsMatt Caswell2015-08-032-4/+337
| | | | | | Add some unit tests for the new PACKET API Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add initial packet parsing codeMatt Caswell2015-08-034-617/+1049
| | | | | | | | | Provide more robust (inline) functions to replace n2s, n2l, etc. These functions do the same thing as the previous macros, but also keep track of the amount of data remaining and return an error if we try to read more data than we've got. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix refactoring breakage.Ben Laurie2015-08-021-4/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* don't reset return value to 0Dr. Stephen Henson2015-08-021-1/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add -Wconditional-uninitialized to clang strict warnings.Ben Laurie2015-08-023-27/+25
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Build with --strict-warnings on FreeBSD.Ben Laurie2015-08-022-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make BSD make happy with subdirectories.Ben Laurie2015-08-011-0/+4
| | | | Reviewed-by: Richard Levitte
* GH336: Return an exit code if report failsDirk Wetter2015-08-011-0/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Only define PAGE_SIZE if not already defined.Ben Laurie2015-07-311-1/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove erroneous server_random fillingMatt Caswell2015-07-311-7/+4
| | | | | | | | | | | | | Commit e481f9b90b164 removed OPENSSL_NO_TLSEXT from the code. Previously if OPENSSL_NO_TLSEXT *was not* defined then the server random was filled during getting of the ClientHello. If it *was* defined then the server random would be filled in ssl3_send_server_hello(). Unfortunately in commit e481f9b90b164 the OPENSSL_NO_TLSEXT guards were removed but *both* server random fillings were left in. This could cause problems for session ticket callbacks. Reviewed-by: Stephen Henson <steve@openssl.org>
* Clear BN-mont values when free'ing it.Loganaden Velvindron2015-07-311-3/+3
| | | | | | From a CloudFlare patch. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Various doc fixes from GH pull requestsRich Salz2015-07-319-20/+18
| | | | | | | | | | | | | | Thanks folks: 348 Benjamin Kaduk 317 Christian Brueffer 254 Erik Tews 253 Erik Tews 219 Carl Mehner 155 (ghost) 95 mancha 51 DominikNeubauer Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* RT3742: Add xmpp_server to s_client.Kai Engert2015-07-312-5/+11
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* RT3963: Allow OCSP stapling with -rev and -wwwAdam Eijdenberg2015-07-311-4/+8
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* RT3962: Check accept_count only if not unlimitedAdam Eijdenberg2015-07-311-1/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* RT3961: Fix switch/case errors in flag parsingAdam Eijdenberg2015-07-313-1/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* RT3959: Fix misleading commentNicholas Cooper2015-07-311-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* cleanse psk_identity on errorDr. Stephen Henson2015-07-301-2/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Free and cleanse pms on errorDr. Stephen Henson2015-07-301-2/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Don't request certificates for any PSK ciphersuiteDr. Stephen Henson2015-07-301-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* CAMELLIA PSK ciphersuites from RFC6367Dr. Stephen Henson2015-07-303-0/+144
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add PSK ciphersuites to docsDr. Stephen Henson2015-07-301-5/+60
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Update CHANGESDr. Stephen Henson2015-07-301-0/+8
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add RFC4785 ciphersuitesDr. Stephen Henson2015-07-302-0/+59
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add RFC4279, RFC5487 and RFC5489 ciphersuites.Dr. Stephen Henson2015-07-302-5/+592
| | | | | | Note: some of the RFC4279 ciphersuites were originally part of PR#2464. Reviewed-by: Matt Caswell <matt@openssl.org>
* Initial new PSK ciphersuite definesDr. Stephen Henson2015-07-301-0/+31
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add full PSK trace supportDr. Stephen Henson2015-07-301-13/+36
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* PSK premaster secret derivation.Dr. Stephen Henson2015-07-301-7/+46
| | | | | | | | Move PSK premaster secret algorithm to ssl_generate_master secret so existing key exchange code can be used and modified slightly to add the PSK wrapping structure. Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-07 19:50:38 +0000