summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2007-04-05Don't use a negative number as a length. Coverity ID 57.Ben Laurie
2007-03-23Stage 1 GOST ciphersuite support.Dr. Stephen Henson
Submitted by: ran@cryptocom.ru Reviewed by: steve@openssl.org
2007-03-21stricter session ID context matchingBodo Möller
2007-02-22Fix incorrect substitution that happened during the recent ciphersuiteBodo Möller
selection remodeling Submitted by: Victor Duchovni
2007-02-21prefer SHA1 over MD5 (this affects the Kerberos ciphersuites)Bodo Möller
2007-02-21delete obsolete commentBodo Möller
2007-02-20SSL_kKRB5 ciphersuites shouldn't be preferred by defaultBodo Möller
2007-02-20Improve ciphersuite order stability when disabling ciphersuites.Bodo Möller
Change ssl_create_cipher_list() to prefer ephemeral ECDH over ephemeral DH.
2007-02-20fix a typo in the new ciphersuite ordering codeBodo Möller
2007-02-19Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that aBodo Möller
ciphersuite string such as "DEFAULT:RSA" cannot enable authentication-only ciphersuites. Also, change ssl_create_cipher_list() so that it no longer starts with an arbitrary ciphersuite ordering, but instead uses the logic that we previously had in SSL_DEFEAULT_CIPHER_LIST. SSL_DEFAULT_CIPHER_LIST simplifies into just "ALL:!aNULL:!eNULL".
2007-02-19fix warnings for CIPHER_DEBUG buildsBodo Möller
2007-02-19fix warnings/inconsistencies caused by the recent changes to theBodo Möller
ciphersuite selection code in HEAD Submitted by: Victor Duchovni
2007-02-19fix incorrect strength bit values for certain Kerberos ciphersuitesBodo Möller
Submitted by: Victor Duchovni
2007-02-17Reorganize the data used for SSL ciphersuite pattern matching.Bodo Möller
This change resolves a number of problems and obviates multiple kludges. A new feature is that you can now say "AES256" or "AES128" (not just "AES", which enables both). In some cases the ciphersuite list generated from a given string is affected by this change. I hope this is just in those cases where the previous behaviour did not make sense.
2007-02-16ensure that the EVP_CIPHER_CTX object is initializedNils Larsch
PR: 1490
2007-02-10use user-supplied malloc functions for persistent kssl objectsNils Larsch
PR: 1467 Submitted by: Andrei Pelinescu-Onciul <andrei@iptel.org>
2007-02-07ensure that a ec key is usedNils Larsch
PR: 1476
2007-01-21Constify version strings is ssl lib.Dr. Stephen Henson
2007-01-03remove undefined constantNils Larsch
2006-12-21fix typosNils Larsch
PR: 1354, 1355, 1398, 1408
2006-11-30Win32 fixes from stable branch.Dr. Stephen Henson
2006-11-29replace macros with functionsNils Larsch
Submitted by: Tracy Camp <tracyx.e.camp@intel.com>
2006-11-29fix support for receiving fragmented handshake messagesBodo Möller
2006-11-21Update from 0.9.8 stable. Eliminate duplicate error codes.Dr. Stephen Henson
2006-11-06remove SSLEAY_MACROS codeNils Larsch
2006-10-20Align data payload for better performance.Andy Polyakov
2006-09-28Fix buffer overflow in SSL_get_shared_ciphers() function.Mark J. Cox
(CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team] Fix SSL client code which could crash if connecting to a malicious SSLv2 server. (CVE-2006-4343) [Tavis Ormandy and Will Drewry, Google Security Team]
2006-09-28Fixes for the following claims:Richard Levitte
1) Certificate Message with no certs OpenSSL implementation sends the Certificate message during SSL handshake, however as per the specification, these have been omitted. -- RFC 2712 -- CertificateRequest, and the ServerKeyExchange shown in Figure 1 will be omitted since authentication and the establishment of a master secret will be done using the client's Kerberos credentials for the TLS server. The client's certificate will be omitted for the same reason. -- RFC 2712 -- 3) Pre-master secret Protocol version The pre-master secret generated by OpenSSL does not have the correct client version. RFC 2712 says, if the Kerberos option is selected, the pre-master secret structure is the same as that used in the RSA case. TLS specification defines pre-master secret as: struct { ProtocolVersion client_version; opaque random[46]; } PreMasterSecret; where client_version is the latest protocol version supported by the client The pre-master secret generated by OpenSSL does not have the correct client version. The implementation does not update the first 2 bytes of random secret for Kerberos Cipher suites. At the server-end, the client version from the pre-master secret is not validated. PR: 1336
2006-09-23Submitted by: Brad Spencer <spencer@jacknife.org>Dr. Stephen Henson
Reviewed by: steve
2006-09-11ensure that ciphersuite strings such as "RC4-MD5" match the SSL 2.0Bodo Möller
ciphersuite as well
2006-08-28Make things static that should be. Declare stuff in headers that should be.Ben Laurie
Fix warnings.
2006-06-15Error messages for client ECC cert verification.Bodo Möller
Also, change the default ciphersuite to give some prefererence to ciphersuites with forwared secrecy (rather than using a random order).
2006-06-15Fix algorithm handling for ECC ciphersuites: Adapt to recent changes,Bodo Möller
and allow more general RSA OIDs for ECC certs with RSA CA sig.
2006-06-15Fix another new bug in the cipherstring logic.Bodo Möller
2006-06-15Fix another bug introduced yesterday when deleting Fortezza stuff:Bodo Möller
make sure 'mask' is initialized in ssl_cipher_get_disabled(). Also simplify code by removing some unused arguments in static functions.
2006-06-15Oops ... deleted too much in the previous commit when I deletedBodo Möller
the Fortezza stuff
2006-06-14Disable invalid ciphersuitesBodo Möller
2006-06-14Ciphersuite string bugfixes, and ECC-related (re-)definitions.Bodo Möller
2006-06-14Make sure that AES ciphersuites get priority over CamelliaBodo Möller
ciphersuites in the default cipher string.
2006-06-14Thread-safety fixesBodo Möller
2006-06-09Camellia cipher, contributed by NTTBodo Möller
Submitted by: Masashi Fujita Reviewed by: Bodo Moeller
2006-05-28Use a new signed int ii instead of j (which is unsigned) to handle theRichard Levitte
return value from sk_SSL_CIPHER_find().
2006-05-26Fix warnings.Dr. Stephen Henson
2006-05-12Someone made a mistake, and some function and reason codes gotRichard Levitte
duplicate numbers. Renumbering.
2006-05-07Fix from stable branch.Dr. Stephen Henson
2006-04-17Fix (most) WIN32 warnings and errors.Dr. Stephen Henson
2006-04-15If cipher list contains a match for an explicit ciphersuite only match thatDr. Stephen Henson
one suite.
2006-04-08Update dependencies.Dr. Stephen Henson
2006-04-05Remove ECC extension information from external representationBodo Möller
of the session -- we don't really need it once the handshake has completed.
2006-04-04Stop warning.Dr. Stephen Henson
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-22 16:40:52 +0000