summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2012-04-26Don't try to use unvalidated composite ciphers in FIPS modeDr. Stephen Henson
2012-04-25Change value of SSL_OP_NO_TLSv1_1 to avoid clash with SSL_OP_ALL andDr. Stephen Henson
OpenSSL 1.0.0. Add CHANGES entry noting the consequences.
2012-04-25s23_clnt.c: ensure interoperability by maitaining client "version capability"Andy Polyakov
vector contiguous [from HEAD]. PR: 2802
2012-04-18correct error codeDr. Stephen Henson
2012-04-17Disable SHA-2 ciphersuites in < TLS 1.2 connections.Bodo Möller
(TLS 1.2 clients could end up negotiating these with an OpenSSL server with TLS 1.2 disabled, which is problematic.) Submitted by: Adam Langley
2012-04-17Additional workaround for PR#2771Dr. Stephen Henson
If OPENSSL_MAX_TLS1_2_CIPHER_LENGTH is set then limit the size of client ciphersuites to this value. A value of 50 should be sufficient. Document workarounds in CHANGES.
2012-04-17Partial workaround for PR#2771.Dr. Stephen Henson
Some servers hang when presented with a client hello record length exceeding 255 bytes but will work with longer client hellos if the TLS record version in client hello does not exceed TLS v1.0. Unfortunately this doesn't fix all cases...
2012-04-16OPENSSL_NO_SOCK fixes [from HEAD].Andy Polyakov
PR: 2791 Submitted by: Ben Noordhuis
2012-04-15s3_srvr.c: fix typo [from HEAD].Andy Polyakov
PR: 2538
2012-04-15e_aes_cbc_hmac_sha1.c: handle zero-length payload and engage empty fragAndy Polyakov
countermeasure [from HEAD]. PR: 2778
2012-04-04ssl/ssl_ciph.c: interim solution for assertion in d1_pkt.c(444) [from HEAD].Andy Polyakov
PR: 2778
2012-03-31PR: 2778(part)Dr. Stephen Henson
Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com> Time is always encoded as 4 bytes, not sizeof(Time).
2012-03-29Experimental workaround to large client hello issue (see PR#2771).Dr. Stephen Henson
If OPENSSL_NO_TLS1_2_CLIENT is set then TLS v1.2 is disabled for clients only.
2012-03-21use client version when deciding whether to send supported signature ↵Dr. Stephen Henson
algorithms extension
2012-03-13ssl/t1_enc.c: pay attention to EVP_CIPH_FLAG_CUSTOM_CIPHER [from HEAD].Andy Polyakov
2012-03-09Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>Dr. Stephen Henson
Add more extension names in s_cb.c extension printing code.
2012-03-09PR: 2756Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Fix DTLS timeout handling.
2012-03-06PR: 2755Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reduce MTU after failed transmissions.
2012-03-06PR: 2748Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Fix possible DTLS timer deadlock.
2012-02-27PR: 2739Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Fix padding bugs in Heartbeat support.
2012-02-22ABI compliance fixes.Dr. Stephen Henson
Move new structure fields to end of structures. Import library codes from 1.0.0 and recreate new ones.
2012-02-17typoDr. Stephen Henson
2012-02-16Fix bug in CVE-2011-4619: check we have really received a client helloDr. Stephen Henson
before rejecting multiple SGC restarts.
2012-02-11Submitted by: Eric Rescorla <ekr@rtfm.com>Dr. Stephen Henson
Further fixes for use_srtp extension.
2012-02-10PR: 2704Dr. Stephen Henson
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Fix srp extension.
2012-02-10Submitted by: Eric Rescorla <ekr@rtfm.com>Dr. Stephen Henson
Fix encoding of use_srtp extension to be compliant with RFC5764
2012-02-09Modify client hello version when renegotiating to enhance interop withDr. Stephen Henson
some servers.
2012-01-22return error if md is NULLDr. Stephen Henson
2012-01-18Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.Dr. Stephen Henson
Thanks to Antonio Martin, Enterprise Secure Access Research and Development, Cisco Systems, Inc. for discovering this bug and preparing a fix. (CVE-2012-0050)
2012-01-151.0.1-specific OPNESSL vs. OPENSSL typo.Andy Polyakov
PR: 2613 Submitted by: Leena Heino
2012-01-05PR: 2652Dr. Stephen Henson
Submitted by: Arpadffy Zoltan <Zoltan.Arpadffy@scientificgames.se> OpenVMS fixes.
2012-01-05Fix for builds without DTLS support.Bodo Möller
Submitted by: Brian Carlstrom
2012-01-05PR: 2671Dr. Stephen Henson
Submitted by: steve Update maximum message size for certifiate verify messages to support 4096 bit RSA keys again as TLS v1.2 messages is two bytes longer.
2012-01-05Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>Dr. Stephen Henson
Reviewed by: steve Send fatal alert if heartbeat extension has an illegal value.
2012-01-04Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>, Michael Tuexen ↵Dr. Stephen Henson
<tuexen@fh-muenster.de> Reviewed by: steve Fix for DTLS plaintext recovery attack discovered by Nadhem Alfardan and Kenny Paterson.
2012-01-04Clear bytes used for block padding of SSL 3.0 records. (CVE-2011-4576)Dr. Stephen Henson
2012-01-04Only allow one SGC handshake restart for SSL/TLS. (CVE-2011-4619)Dr. Stephen Henson
2012-01-04Submitted by: Adam Langley <agl@chromium.org>Dr. Stephen Henson
Reviewed by: steve Fix memory leaks.
2012-01-03only send heartbeat extension from server if client sent oneDr. Stephen Henson
2012-01-02make updateDr. Stephen Henson
2011-12-31PR: 2658Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-27make updateDr. Stephen Henson
2011-12-27PR: 1794Dr. Stephen Henson
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve - remove some unncessary SSL_err and permit an srp user callback to allow a worker to obtain a user verifier. - cleanup and comments in s_server and demonstration for asynchronous srp user lookup
2011-12-26PR: 2326Dr. Stephen Henson
Submitted by: Tianjie Mao <tjmao@tjmao.net> Reviewed by: steve Fix incorrect comma expressions and goto f_err as alert has been set.
2011-12-25PR: 2535Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Add SCTP support for DTLS (RFC 6083).
2011-12-23typoDr. Stephen Henson
2011-12-23delete unimplemented function from header file, update ordinalsDr. Stephen Henson
2011-12-22remove prototype for deleted SRP functionDr. Stephen Henson
2011-12-22New ctrl values to clear or retrieve extra chain certs from an SSL_CTX.Dr. Stephen Henson
New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.
2011-12-20Fix DTLS.Ben Laurie
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-12 11:05:39 +0000