Age | Commit message (Collapse) | Author |
|
Regression test against CVE-2014-0160 (Heartbleed).
More info: http://mike-bland.com/tags/heartbleed.html
(based on commit 35cb55988b75573105eefd00d27d0138eebe40b1)
|
|
|
|
Replace manual ASN.1 decoder with ASN1_get object. This
will decode the tag and length properly and check against
it does not exceed the supplied buffer length.
PR#3335
(cherry picked from commit b0308dddd1cc6a8e1de803ef29ba6da25ee072c2)
|
|
|
|
PR: 3317
|
|
buffer. PR#3320
|
|
|
|
|
|
|
|
|
|
Fix typo that stopped SSL_CTX_get_{first,next}_certificate from working.
(cherry picked from commit 9330a85e0499f10752434c451977d65d80d8de19)
|
|
(cherry picked from commit a74bee5fc7929c55421d111cc5058a8eba8b97e1)
|
|
(cherry picked from commit 55c9e2487552f732e3d96c5ed8e588530b1aebb8)
|
|
A missing bounds check in the handling of the TLS heartbeat extension
can be used to reveal up to 64k of memory to a connected client or
server.
Thanks for Neel Mehta of Google Security for discovering this bug and to
Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
preparing the fix (CVE-2014-0160)
(cherry picked from commit 96db9023b881d7cd9f379b0c154650d6c108e9a3)
|
|
Enable TLS padding extension using official value from:
http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
(cherry picked from commit cd6bd5ffda616822b52104fee0c4c7d623fd4f53)
Conflicts:
CHANGES
|
|
|
|
|
|
Don't clear verification errors from the error queue unless
SSL_BUILD_CHAIN_FLAG_CLEAR_ERROR is set.
If errors occur during verification and SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR
is set return 2 so applications can issue warnings.
|
|
|
|
(cherry picked from commit f04665a653665cd6432b9adfeb7c7f12a7447d26)
|
|
(cherry picked from commit a029788b0e0c19cee4007cc1f73201cf2c13addf)
|
|
Submitted by: Roumen Petrov
(cherry picked from commit 972b0dc3500a26edb178a5446a0cdfb8f450f853)
|
|
Although the memory allocated by compression methods is fixed and
cannot grow over time it can cause warnings in some leak checking
tools. The function SSL_COMP_free_compression_methods() will free
and zero the list of supported compression methods. This should
*only* be called in a single threaded context when an application
is shutting down to avoid interfering with existing contexts
attempting to look up compression methods.
|
|
|
|
|
|
PR: 3201
(cherry picked from commit 03da57fe14f2de5bde9d4496a2ae9a4ae8879f88)
|
|
|
|
When setting the current certificate check that it has a corresponding
private key.
(cherry picked from commit 358d352aa244b4f2ef655bccff6658d92d5ce03c)
|
|
New flags to build certificate chains. The can be used to rearrange
the chain so all an application needs to do is add all certificates
in arbitrary order and then build the chain to check and correct them.
Add verify error code when building chain.
Update docs.
(cherry picked from commit 13dc3ce9ab483cade378bcf3844c92bacd817316)
|
|
(cherry picked from commit daddd9a950e491c31f9500d5e570bc7eb96b2823)
|
|
|
|
|
|
|
|
Certificate/OCSP Extensions.
Add the RFC6962 OIDs to the objects table.
(backport from master branch)
|
|
|
|
(cherry picked from commit 701134320a94908d8c0ac513741cab41e215a7b5)
|
|
|
|
|
|
|
|
(cherry picked from commit 5eda213ebe382009c2f37a8eade5cbcdae6017ed)
Conflicts:
apps/s_client.c
apps/s_server.c
|
|
(cherry picked from commit a6a48e87bc469f37ed1c53d0e4d22faaa0a5adf3)
Conflicts:
ssl/s3_clnt.c
ssl/t1_lib.c
|
|
from commit 835d104f46c4448a27844a9309de456c7972a943
|
|
The contract for custom extension callbacks has changed - all custom extension callbacks are triggered
|
|
|
|
Whitespace fixes
(cherry picked from commit e9add063b50e8a460d5636055156d2760c2fe29f)
Conflicts:
ssl/s3_clnt.c
|
|
|
|
support sending an alert.
If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake.
Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.
(cherry picked from commit ac20719d994729970eb3b775c7bffa81f0e9f960)
Conflicts:
ssl/t1_lib.c
|
|
reinstated.
|
|
entries, facilitating RFC 5878 (TLS auth extensions)
Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API
Tests exercising the new supplemental data registration and callback api can be found in ssltest.c.
Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
(cherry picked from commit 36086186a9b90cdad0d2cd0a598a10f03f8f4bcc)
Conflicts:
Configure
apps/s_client.c
apps/s_server.c
ssl/ssl.h
ssl/ssl3.h
ssl/ssltest.c
|
|
(cherry picked from commit b45e874d7c4a8fdac7ec10cff43f21d02e75d511)
|