summaryrefslogtreecommitdiffstats
path: root/ssl/ssl_lib.c
AgeCommit message (Collapse)Author
2013-02-05Fix error codes.Dr. Stephen Henson
(cherry picked from commit 35d732fc2e1badce13be22a044187ebd4d769552)
2012-10-05backport OCSP fix enhancementDr. Stephen Henson
2012-10-05Backport OCSP fix.Ben Laurie
2012-01-05Fix for builds without DTLS support.Bodo Möller
Submitted by: Brian Carlstrom
2011-09-26fix signed/unsigned warningDr. Stephen Henson
2011-09-23PR: 2602Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Fix DTLS bug which prevents manual MTU setting
2010-06-12Fix gcc 4.6 warnings. Check TLS server hello extension length.Ben Laurie
2010-02-17OR default SSL_OP_LEGACY_SERVER_CONNECT so existing options are preservedDr. Stephen Henson
2010-01-07Simplify RI+SCSV logic:Dr. Stephen Henson
1. Send SCSV is not renegotiating, never empty RI. 2. Send RI if renegotiating.
2010-01-06Updates to conform with draft-ietf-tls-renegotiation-03.txt:Dr. Stephen Henson
1. Add provisional SCSV value. 2. Don't send SCSV and RI at same time. 3. Fatal error is SCSV received when renegotiating.
2009-12-27Update RI to match latest spec.Dr. Stephen Henson
MCSV is now called SCSV. Don't send SCSV if renegotiating. Also note if RI is empty in debug messages.
2009-12-16New option to enable/disable connection to unpatched serversDr. Stephen Henson
2009-12-09Document option clearning functions.Dr. Stephen Henson
Initial secure renegotiation documentation.
2009-12-09Add ctrls to clear options and mode.Dr. Stephen Henson
Change RI ctrl so it doesn't clash.
2009-12-08Add ctrl and macro so we can determine if peer support secure renegotiation.Dr. Stephen Henson
Fix SSL_CIPHER initialiser for mcsv
2009-12-08Add support for magic cipher suite value (MCSV). Make secure renegotiationDr. Stephen Henson
work in SSLv3: initial handshake has no extensions but includes MCSV, if server indicates RI support then renegotiation handshakes include RI. NB: current MCSV value is bogus for testing only, will be updated when we have an official value. Change mismatch alerts to handshake_failure as required by spec. Also have some debugging fprintfs so we can clearly see what is going on if OPENSSL_RI_DEBUG is set.
2009-10-16PR: 2073Dr. Stephen Henson
Submitted by: Tomas Mraz <tmraz@redhat.com> Approved by: steve@openssl.org Don't access freed SSL_CTX in SSL_free().
2009-04-19PR: 1751Dr. Stephen Henson
Submitted by: David Woodhouse <dwmw2@infradead.org> Approved by: steve@openssl.org Compatibility patches for Cisco VPN client DTLS.
2009-02-23Fix memory leak.Ben Laurie
2008-06-16Make ssl code consistent with FIPS branch. The new code has no effectDr. Stephen Henson
at present because it asserts either noop flags or is inside OPENSSL_FIPS #ifdef's.
2008-06-05If auto load ENGINE lookup fails retry adding builtin ENGINEs.Dr. Stephen Henson
2008-06-05include engine.h if needed.Dr. Stephen Henson
2008-06-04Update from HEAD.Dr. Stephen Henson
2007-10-12Backport certificate status request TLS extension support to 0.9.8.Dr. Stephen Henson
2007-09-19Lingering "security" fix.Ben Laurie
2007-08-12Backport of TLS extension code to OpenSSL 0.9.8.Dr. Stephen Henson
Include server name and RFC4507bis support. This is not compiled in by default and must be explicitly enabled with the Configure option enable-tlsext
2006-11-29replace macros with functionsNils Larsch
Submitted by: Tracy Camp <tracyx.e.camp@intel.com>
2006-09-28Introduce limits to prevent malicious keys being able toMark J. Cox
cause a denial of service. (CVE-2006-2940) [Steve Henson, Bodo Moeller] Fix ASN.1 parsing of certain invalid structures that can result in a denial of service. (CVE-2006-2937) [Steve Henson] Fix buffer overflow in SSL_get_shared_ciphers() function. (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team] Fix SSL client code which could crash if connecting to a malicious SSLv2 server. (CVE-2006-4343) [Tavis Ormandy and Will Drewry, Google Security Team]
2005-12-05Fix from HEAD.Dr. Stephen Henson
2005-09-30Update from HEAD.Dr. Stephen Henson
2005-08-28fix warnings when building openssl with (gcc 3.3.1):Nils Larsch
-Wmissing-prototypes -Wcomment -Wformat -Wimplicit -Wmain -Wmultichar -Wswitch -Wshadow -Wtrigraphs -Werror -Wchar-subscripts -Wstrict-prototypes -Wreturn-type -Wpointer-arith -W -Wunused -Wno-unused-parameter -Wuninitialized
2005-07-16makeNils Larsch
./configure no-deprecated [no-dsa] [no-dh] [no-ec] [no-rsa] make all test work again (+ make update) PR: 1159
2005-06-23DCC doesn't like argument names in returned function pointers.Richard Levitte
PR: 1122
2005-06-10- let SSL_CTX_set_cipher_list and SSL_set_cipher_list return anNils Larsch
error if the cipher list is empty - fix last commit in ssl_create_cipher_list - clean up ssl_create_cipher_list
2005-05-11Don't use the SSL 2.0 Client Hello format if SSL 2.0 is disabledBodo Möller
with the SSL_OP_NO_SSLv2 option.
2005-04-26Fix various incorrect error function codes.Bodo Möller
("perl util/ck_errf.pl */*.c */*/*.c" still reports many more.)
2005-04-26Add DTLS support.Ben Laurie
2005-04-13More cover-ups, removing OPENSSL_GLOBAL/EXTERNS. We can remove more...Andy Polyakov
2005-03-31Give everything prototypes (well, everything that's actually used).Ben Laurie
2005-03-30Constification.Ben Laurie
2005-01-12Small typo, `mask' got the same value ORed to it twice instead ofRichard Levitte
`mask' and `emask' getting that operation done once each. Patch supplied by Nils Larsch <nils.larsch@cybertrust.com>
2004-09-06New X509_VERIFY_PARAM structure and associated functionality.Dr. Stephen Henson
This tidies up verify parameters and adds support for integrated policy checking. Add support for policy related command line options. Currently only in smime application. WARNING: experimental code subject to change.
2004-04-19(oops) Apologies all, that last header-cleanup commit was from the wrongGeoff Thorpe
tree. This further reduces header interdependencies, and makes some associated cleanups.
2003-12-27Avoid including cryptlib.h, it's not really needed.Richard Levitte
Check if IDEA is being built or not. This is part of a large change submitted by Markus Friedl <markus@openbsd.org>
2003-10-06Add functionality to get information on compression methods (not quite ↵Richard Levitte
complete).
2003-09-27Free the Kerberos context upon freeing the SSL.Richard Levitte
Contributed by Andrew Mann <amann@tccgi.com>
2003-01-30Fix a memory leak in SSL.Richard Levitte
PR: 477
2003-01-16Fix possible NULL dereferencial.Richard Levitte
Notified by Verdon Walker <VWalker@novell.com>
2002-11-13Security fixes brought forward from 0.9.7.Ben Laurie
2002-10-29Correct and enhance the behaviour of "internal" session caching as itGeoff Thorpe
relates to SSL_CTX flags and the use of "external" session caching. The existing flag, "SSL_SESS_CACHE_NO_INTERNAL_LOOKUP" remains but is supplemented with a complimentary flag, "SSL_SESS_CACHE_NO_INTERNAL_STORE". The bitwise OR of the two flags is also defined as "SSL_SESS_CACHE_NO_INTERNAL" and is the flag that should be used by most applications wanting to implement session caching *entirely* by its own provided callbacks. As the documented behaviour contradicted actual behaviour up until recently, and since that point behaviour has itself been inconsistent anyway, this change should not introduce any compatibility problems. I've adjusted the relevant documentation to elaborate about how this works. Kudos to "Nadav Har'El" <nyh@math.technion.ac.il> for diagnosing these anomalies and testing this patch for correctness. PR: 311
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-03 11:34:31 +0000