generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
10,977 Commits 16 Branches 258 Tags
Commit Graph

1512 Commits

Author SHA1 Message Date
Dr. Stephen Henson
e5f706590c Fix CVE-2014-3470 
Check session_cert is not NULL before dereferencing it.
(cherry picked from commit 8011cd56e39a433b1837465259a9bd24a38727fb)
 2014-06-05 13:24:30 +01:00
David Benjamin
56b94a38b9 Check there is enough room for extension. 
(cherry picked from commit 7d89b3bf42e4b4067371ab33ef7631434e41d1e4)
 2014-06-02 18:59:48 +01:00
zhu qun-ying
d52eb82781 Free up s->d1->buffered_app_data.q properly. 
PR#3286
(cherry picked from commit 71e95000afb2227fe5cac1c79ae884338bcd8d0b)
 2014-06-02 14:40:05 +01:00
Sami Farin
6468866823 Typo: set i to -1 before goto. 
PR#3302
(cherry picked from commit 9717f01951f976f76dd40a38d9fc7307057fa4c4)
 2014-06-02 13:53:54 +01:00
Matt Caswell
de8a5b523f Added SSLErr call for internal error in dtls1_buffer_record 2014-06-01 21:40:31 +01:00
David Ramos
8de85b0048 Delays the queue insertion until after the ssl3_setup_buffers() call due to use-after-free bug. PR#3362 2014-06-01 21:40:25 +01:00
Dr. Stephen Henson
623a01df49 Option to disable padding extension. 
Add TLS padding extension to SSL_OP_ALL so it is used with other
"bugs" options and can be turned off.

This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient
option referring to SSLv2 and SSLREF.

PR#3336
(cherry picked from commit 758415b2259fa45d3fe17d8e53ae1341b7b6e482)

Conflicts:

	ssl/t1_lib.c
 2014-06-01 16:50:25 +01:00
David Ramos
856a4585d6 Allocate extra space when NETSCAPE_HANG_BUG defined. 
Make sure there is an extra 4 bytes for server done message when
NETSCAPE_HANG_BUG is defined.

PR#3361
(cherry picked from commit 92d81ba622396425764d676ba4fb3f0dac273f17)
 2014-06-01 14:27:58 +01:00
Dr. Stephen Henson
87a0cbdf2e Use correct digest when exporting keying material. 
PR#3319
(cherry picked from commit 84691390eae86befd33c83721dacedb539ae34e6)
 2014-05-30 13:24:36 +01:00
Dr. Stephen Henson
b5bdde9e0e Don't compile heartbeat test code on Windows (for now). 
(cherry picked from commit 2c575907d2c8601a18716f718ce309ed4e1f1783)
 2014-05-30 13:12:26 +01:00
Mike Bland
8db2ba4b84 Fix heartbeat_test for -DOPENSSL_NO_HEARTBEATS 
Replaces the entire test with a trivial implementation when
OPENSSL_NO_HEARTBEATS is defined.
 2014-05-22 22:02:46 +01:00
Ben Laurie
5cd1a6fc3e Fix signed/unsigned warning. 2014-05-20 15:14:30 +01:00
Dr. Stephen Henson
81ce94f8dc For portability use BUF_strndup instead of strndup. 
(cherry picked from commit dcca7b13e9066443237dd3001ae52fd103151c98)
 2014-05-20 11:22:33 +01:00
Dr. Stephen Henson
feaa3b380b Adding padding extension to trace code. 
(cherry picked from commit 6db14dbc514d6b8017827baebea4c75af8bb1976)
 2014-05-20 11:22:15 +01:00
Mike Bland
2312a84ca1 Unit/regression test for TLS heartbeats. 
Regression test against CVE-2014-0160 (Heartbleed).

More info: http://mike-bland.com/tags/heartbleed.html

(based on commit 35cb55988b75573105eefd00d27d0138eebe40b1)
 2014-05-18 10:23:59 -04:00
Kurt Roeckx
1f5bce2dce Check sk_SSL_CIPHER_num() after assigning sk. 2014-05-12 22:59:11 +01:00
Serguei E. Leontiev
d6e55b4001 Replace manual ASN1 decoder with ASN1_get_object 
Replace manual ASN.1 decoder with ASN1_get object. This
will decode the tag and length properly and check against
it does not exceed the supplied buffer length.

PR#3335
(cherry picked from commit b0308dddd1cc6a8e1de803ef29ba6da25ee072c2)
 2014-05-12 18:41:51 +01:00
Matt Caswell
f710c3f198 Fixed NULL pointer dereference. See PR#3321 2014-05-12 00:39:43 +01:00
Günther Noack
8571902e23 Avoid out-of-bounds write in SSL_get_shared_ciphers 
PR: 3317
 2014-05-11 23:55:06 +01:00
Matt Caswell
f2ebe2a60e Move length check earlier to ensure we don't go beyond the end of the user's buffer. PR#3320 2014-05-11 11:32:17 +01:00
Tim Hudson
011ee91105 safety check to ensure we dont send out beyond the users buffer 2014-05-11 11:32:17 +01:00
Tim Hudson
afe343c3a7 fix coverity issue 966597 - error line is not always initialised 2014-05-07 23:57:00 +01:00
Matt Caswell
7441e7dbe9 Fixed spelling error in error message. Fix supplied by Marcos Marado 2014-05-01 00:27:02 +01:00
Ben Laurie
a0fe2e72c4 Fix use after free. 2014-04-23 07:30:16 +01:00
Kaspar Brand
5aeb43393b Fix SSL_CTX_get{first,next}_certificate. 
Fix typo that stopped SSL_CTX_get_{first,next}_certificate from working.
(cherry picked from commit 9330a85e0499f10752434c451977d65d80d8de19)
 2014-04-21 16:53:48 +01:00
Steven M. Schweda
6ef9d9bacf VMS build fix #2. 
(cherry picked from commit a74bee5fc7929c55421d111cc5058a8eba8b97e1)
 2014-04-08 17:28:23 +01:00
Steven M. Schweda
40a44a7c3d VMS build fix for older compilers. 
(cherry picked from commit 55c9e2487552f732e3d96c5ed8e588530b1aebb8)
 2014-04-07 23:15:31 +01:00
Dr. Stephen Henson
7e840163c0 Add heartbeat extension bounds check. 
A missing bounds check in the handling of the TLS heartbeat extension
can be used to reveal up to 64k of memory to a connected client or
server.

Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix (CVE-2014-0160)
(cherry picked from commit 96db9023b881d7cd9f379b0c154650d6c108e9a3)
 2014-04-07 19:25:34 +01:00
Dr. Stephen Henson
6411b83e52 Set TLS padding extension value. 
Enable TLS padding extension using official value from:

http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
(cherry picked from commit cd6bd5ffda616822b52104fee0c4c7d623fd4f53)

Conflicts:

	CHANGES
 2014-04-05 20:49:09 +01:00
Dr. Stephen Henson
bc5ec653ba Fix memory leak with client auth. 2014-03-27 16:10:50 +00:00
Dr. Stephen Henson
1f44dac24d Add -no_resumption_on_reneg to SSL_CONF. 2014-03-27 15:51:25 +00:00
Dr. Stephen Henson
2dd6976f6d Update chain building function. 
Don't clear verification errors from the error queue unless
SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR is set.

If errors occur during verification and SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR
is set return 2 so applications can issue warnings.
 2014-03-27 14:23:46 +00:00
Emilia Kasper
662239183d Allow duplicate certs in ssl_build_cert_chain 2014-03-25 17:28:04 +00:00
Piotr Sikora
aa10982c49 Retry callback only after ClientHello received. 
(cherry picked from commit f04665a653665cd6432b9adfeb7c7f12a7447d26)
 2014-03-18 23:58:39 +00:00
Dr. Stephen Henson
44f7e399d3 typo 
(cherry picked from commit a029788b0e0c19cee4007cc1f73201cf2c13addf)
 2014-03-10 15:48:12 +00:00
Andy Polyakov
25ebd9e3ce bss_dgram.c,d1_lib.c: make it compile with mingw. 
Submitted by: Roumen Petrov
(cherry picked from commit 972b0dc3500a26edb178a5446a0cdfb8f450f853)
 2014-03-06 14:07:16 +01:00
Dr. Stephen Henson
976c58302b Add function to free compression methods. 
Although the memory allocated by compression methods is fixed and
cannot grow over time it can cause warnings in some leak checking
tools. The function SSL_COMP_free_compression_methods() will free
and zero the list of supported compression methods. This should
*only* be called in a single threaded context when an application
is shutting down to avoid interfering with existing contexts
attempting to look up compression methods.
 2014-03-01 23:14:08 +00:00
Dr. Stephen Henson
d1201e3195 Fix compilation errors with no-nextprotoneg 2014-02-28 13:35:30 +00:00
Dr. Stephen Henson
73be56a21d Fix for WIN32 builds with KRB5 2014-02-26 15:33:10 +00:00
Andy Polyakov
8d08627c94 ssl/t1_enc.c: check EVP_MD_CTX_copy return value. 
PR: 3201
(cherry picked from commit 03da57fe14f2de5bde9d4496a2ae9a4ae8879f88)
 2014-02-25 22:23:49 +01:00
Dr. Stephen Henson
3678161d71 Don't use BN_ULLONG in n2l8 use SCTS_TIMESTAMP. 2014-02-25 15:05:08 +00:00
Dr. Stephen Henson
c3f5d3d93a Only set current certificate to valid values. 
When setting the current certificate check that it has a corresponding
private key.
(cherry picked from commit 358d352aa244b4f2ef655bccff6658d92d5ce03c)
 2014-02-23 13:49:21 +00:00
Dr. Stephen Henson
c5ea65b157 New chain building flags. 
New flags to build certificate chains. The can be used to rearrange
the chain so all an application needs to do is add all certificates
in arbitrary order and then build the chain to check and correct them.

Add verify error code when building chain.

Update docs.
(cherry picked from commit 13dc3ce9ab483cade378bcf3844c92bacd817316)
 2014-02-23 13:49:21 +00:00
Dr. Stephen Henson
58b86e4235 Option to set current cert to server certificate. 
(cherry picked from commit daddd9a950e491c31f9500d5e570bc7eb96b2823)
 2014-02-23 13:49:21 +00:00
Ben Laurie
a466be6243 Fix typo. 2014-02-23 11:21:39 +00:00
Andy Polyakov
6b3b6beaa1 ssl/ssl_cert.c: DANE update. 2014-02-21 12:12:25 +01:00
Dr. Stephen Henson
b709f8ef54 fix WIN32 warnings 2014-02-20 22:41:06 +00:00
Rob Stradling
c74ce24cd2 Show the contents of the RFC6962 Signed Certificate Timestamp List Certificate/OCSP Extensions. 
Add the RFC6962 OIDs to the objects table.
(backport from master branch)
 2014-02-20 21:43:54 +00:00
Dr. Stephen Henson
d69acceca9 Fix error discrepancy with 1.0.1 2014-02-14 17:50:20 +00:00
Andy Polyakov
aff78bb39a ssl/s3_pkt.c: detect RAND_bytes error in multi-block. 
(cherry picked from commit 701134320a94908d8c0ac513741cab41e215a7b5)
 2014-02-14 17:45:33 +01:00