summaryrefslogtreecommitdiff
path: root/ssl
Commit message (Collapse)AuthorAgeFilesLines
* Properly check EVP_VerifyFinal() and similar return valuesDr. Stephen Henson2009-01-075-8/+8
| | | | | (CVE-2008-5077). Submitted by: Ben Laurie, Bodo Moeller, Google Security Team
* Fix compilation with -no-comp by adding some more #ifndef OPENSSL_NO_COMPLutz Jänicke2009-01-054-0/+11
| | | | | | Some #include statements were not properly protected. This will go unnoted on most systems as openssl/comp.h tends to be installed as a system header file by default but may become visible when cross compiling.
* Avoid signed/unsigned compare warnings.Dr. Stephen Henson2008-12-291-1/+1
|
* Make -DKSSL_DEBUG work again.Dr. Stephen Henson2008-11-103-23/+32
|
* Firstly, the bitmap we use for replay protection was ending up with zeroLutz Jänicke2008-10-132-0/+2
| | | | | | | | | | length, so a _single_ pair of packets getting switched around would cause one of them to be 'dropped'. Secondly, it wasn't even _dropping_ the offending packets, in the non-blocking case. It was just returning garbage instead. PR: #1752 Submitted by: David Woodhouse <dwmw2@infradead.org>
* When the underlying BIO_write() fails to send a datagram, we leave theLutz Jänicke2008-10-101-1/+8
| | | | | | | | | | | offending record queued as 'pending'. The DTLS code doesn't expect this, and we end up hitting an OPENSSL_assert() in do_dtls1_write(). The simple fix is just _not_ to leave it queued. In DTLS, dropping packets is perfectly acceptable -- and even preferable. If we wanted a service with retries and guaranteed delivery, we'd be using TCP. PR: #1703 Submitted by: David Woodhouse <dwmw2@infradead.org>
* Make sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG can'tBodo Möller2008-09-221-13/+19
| | | | enable disabled ciphersuites.
* Make update: delete duplicate error code.Dr. Stephen Henson2008-09-171-587/+610
|
* Updates to build system from FIPS branch. Make fipscanisterbuild work andDr. Stephen Henson2008-09-171-1/+1
| | | | build FIPS test programs.
* update commentBodo Möller2008-09-141-1/+1
|
* oopsBodo Möller2008-09-141-2/+2
|
* dtls1_write_bytes consumers expect amount of bytes written per call, notAndy Polyakov2008-09-141-1/+1
| | | | | overall [from HEAD]. PR: 1604
* Fix error code discrepancy.Dr. Stephen Henson2008-09-141-472/+493
| | | | Make update.
* Fix SSL state transitions.Bodo Möller2008-09-142-6/+6
| | | | Submitted by: Nagendra Modadugu
* Some precautions to avoid potential security-relevant problems.Bodo Möller2008-09-141-1/+1
|
* DTLS didn't handle alerts correctly [from HEAD].Andy Polyakov2008-09-133-3/+25
| | | | PR: 1632
* If tickets disabled behave as if no ticket received to supportDr. Stephen Henson2008-09-031-6/+8
| | | | stateful resume.
* sanity checkBodo Möller2008-08-133-0/+9
| | | | PR: 1679
* Make ssl code consistent with FIPS branch. The new code has no effectDr. Stephen Henson2008-06-1613-31/+111
| | | | | at present because it asserts either noop flags or is inside OPENSSL_FIPS #ifdef's.
* If auto load ENGINE lookup fails retry adding builtin ENGINEs.Dr. Stephen Henson2008-06-051-0/+6
|
* include engine.h if needed.Dr. Stephen Henson2008-06-051-0/+3
|
* Update from HEAD.Dr. Stephen Henson2008-06-041-0/+19
|
* Backport more ENGINE SSL client auth code to 0.9.8.Dr. Stephen Henson2008-06-046-5/+60
|
* Backport ssl client auth ENGINE support to 0.9.8.Dr. Stephen Henson2008-06-041-3/+0
|
* fix whitespaceBodo Möller2008-05-281-6/+6
|
* Fix flaw if 'Server Key exchange message' is omitted from a TLSMark J. Cox2008-05-281-0/+7
| | | | | | | | | handshake which could lead to a cilent crash as found using the Codenomicon TLS test suite (CVE-2008-1672) Reviewed by: openssl-security@openssl.org Obtained from: mark@awe.com
* Fix double-free in TLS server name extensions which could lead to a remoteMark J. Cox2008-05-281-0/+1
| | | | | | | | crash found by Codenomicon TLS test suite (CVE-2008-0891) Reviewed by: openssl-security@openssl.org Obtained from: jorton@redhat.com
* Reword comment to be much shorter to stop other people from complainingLutz Jänicke2008-05-261-5/+1
| | | | about "overcommenting"
* Clear error queue when starting SSL_CTX_use_certificate_chain_fileLutz Jänicke2008-05-231-0/+6
| | | | | PR: 1417, 1513 Submitted by: Erik de Castro Lopo <mle+openssl@mega-nerd.com>
* TLS ticket key setting callback: this allows and application to setDr. Stephen Henson2008-04-305-30/+82
| | | | its own TLS ticket keys.
* Do not permit stateless session resumption is session IDs mismatch.Dr. Stephen Henson2008-04-291-1/+5
|
* Support ticket renewal in state machine (not used at present).Dr. Stephen Henson2008-04-291-2/+11
|
* Status strings for ticket states.Dr. Stephen Henson2008-04-291-0/+4
|
* Fix from HEAD.Dr. Stephen Henson2008-04-251-1/+9
|
* Avoid "initializer not constant" errors when compiling in pedantic mode.Dr. Stephen Henson2008-04-021-1/+1
|
* Make depend.Ben Laurie2007-11-151-21/+23
|
* Allow new session ticket when resuming.Dr. Stephen Henson2007-11-031-1/+4
|
* Ensure the ticket expected flag is reset when a stateless resumption isDr. Stephen Henson2007-10-181-0/+1
| | | | successful.
* New unused field crippled ssl_ctx_st in 0.9.8"f".Andy Polyakov2007-10-171-1/+0
|
* Don't let DTLS ChangeCipherSpec increment handshake sequence number. FromAndy Polyakov2007-10-172-4/+6
| | | | | HEAD with a twist: server interoperates with non-compliant client. PR: 1587
* Don't try to lookup zero length session.Dr. Stephen Henson2007-10-171-1/+3
|
* Allow TLS tickets and session ID to both be present if lifetime hint is -1.Dr. Stephen Henson2007-10-171-6/+9
| | | | | This never happens in normal SSL sessions but can be useful if the session is being used as a "blob" to contain other data.
* Make ssl compile.Andy Polyakov2007-10-142-0/+2
|
* Avoid shadow and signed/unsigned warnings.Dr. Stephen Henson2007-10-121-8/+8
|
* Backport certificate status request TLS extension support to 0.9.8.Dr. Stephen Henson2007-10-1211-6/+521
|
* make update, and more DTLS stuff.Ben Laurie2007-10-114-615/+541
|
* Respect cookie length set by app_gen_cookie_cb [from HEAD].Andy Polyakov2007-10-091-2/+1
| | | | Submitted by: Alex Lam
* Make DTLS1 record layer MAC calculation RFC compliant. From HEAD with aAndy Polyakov2007-10-091-5/+25
| | | | twist: server interoperates with non-compliant pre-0.9.8f client.
* Prohibit RC4 in DTLS [from HEAD].Andy Polyakov2007-10-052-1/+23
|
* Set client_version earlier in DTLS (this is 0.9.8 specific).Andy Polyakov2007-10-031-0/+1
|
View Lorry Controller Status