mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-25 11:03:37 +08:00
Code Issues Packages Projects Releases Wiki Activity
12,093 Commits 33 Branches 385 Tags 435 MiB
11da66f8b1
Commit Graph

12093 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Dr. Stephen Henson
11da66f8b1 Tolerate critical AKID in CRLs. 
PR#3014
 2014-06-27 18:49:32 +01:00
PK
e633248921 Add SHA256 Camellia ciphersuites from RFC5932 
PR#2800
 2014-06-27 18:24:05 +01:00
Tom Greenslade
b36f35cda9 Handle IPv6 addresses in OCSP_parse_url. 
PR#2783
 2014-06-27 17:30:59 +01:00
Tomas Mraz
0436369fcc Don't advertise ECC ciphersuits in SSLv2 compatible client hello. 
PR#3374
 2014-06-27 16:51:26 +01:00
Jeffrey Walton
0535c2d67c Clarify docs. 
Document that the certificate passed to SSL_CTX_add_extra_chain_cert()
should not be freed by the application.

PR#3409
 2014-06-27 16:39:11 +01:00
Dr. Stephen Henson
abac8e0e08 Rebuild OID table. 2014-06-27 14:35:07 +01:00
Dr. Stephen Henson
95791bf941 Fix OID encoding for one component. 
OIDs with one component don't have an encoding.

PR#2556 (Bug#1)
 2014-06-27 14:35:07 +01:00
Dr. Stephen Henson
d2aea03829 Memory leak and NULL dereference fixes. 
PR#3403
 2014-06-27 14:35:07 +01:00
Huzaifa Sidhpurwala
3b3b69ab25 Make sure BN_sqr can never return a negative value. 
PR#3410
 2014-06-26 23:56:34 +01:00
Dr. Stephen Henson
7be6b27aaf Remove ancient obsolete files under pkcs7. 2014-06-26 23:56:34 +01:00
Andy Polyakov
f3f620e1e0 bn_exp.c: move check for AD*X to rsaz-avx2.pl. 
This ensures high performance is situations when assembler supports
AVX2, but not AD*X.
 2014-06-27 00:07:15 +02:00
Andy Polyakov
052ecf91d2 aesp8-ppc.pl: rigid input verification in key setup. 2014-06-25 22:13:17 +02:00
Andy Polyakov
7b8c8c4d79 aesv8-armx.pl: rigid input verification in key setup. 2014-06-25 22:10:45 +02:00
Andy Polyakov
7eb0488280 x86_64 assembly pack: addendum to last clang commit. 2014-06-24 08:37:05 +02:00
Andy Polyakov
ac171925ab x86_64 assembly pack: allow clang to compile AVX code. 2014-06-24 08:24:25 +02:00
Andy Polyakov
015364baf3 aesv8-armx.pl: inclrease interleave factor. 
This is to compensate for higher aes* instruction latency on Cortex-A57.
 2014-06-24 08:08:58 +02:00
Andy Polyakov
0f777aeb50 ARMv8 assembly pack: add Cortex performance numbers. 2014-06-24 08:06:05 +02:00
Viktor Dukhovni
eef1827f89 One more typo when changing !result to result <= 0 2014-06-23 16:26:34 +01:00
Viktor Dukhovni
90b70a6a6b Fix typo in last commit 2014-06-22 20:39:52 -04:00
Viktor Dukhovni
8abffa4a73 Multiple verifier reference identities. 
Implemented as STACK_OF(OPENSSL_STRING).
 2014-06-22 20:32:35 -04:00
Viktor Dukhovni
66d884f067 Implement sk_deep_copy. 2014-06-22 20:24:18 -04:00
Viktor Dukhovni
29edebe95c More complete input validation of X509_check_mumble 2014-06-22 20:18:53 -04:00
Viktor Dukhovni
a48fb0400c X509_check_mumble() failure is <= 0, not just 0 2014-06-22 20:14:53 -04:00
Viktor Dukhovni
b3012c698a Drop hostlen from X509_VERIFY_PARAM_ID. 
Just store NUL-terminated strings.  This works better when we add
support for multiple hostnames.
 2014-06-22 19:52:44 -04:00
Viktor Dukhovni
d241b80409 More complete X509_check_host documentation. 2014-06-22 19:50:02 -04:00
Miod Vallat
2841d6ca9f Fix off-by-one errors in ssl_cipher_get_evp() 
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays.

Bug discovered and fixed by Miod Vallat from the OpenBSD team.

PR#3375
 2014-06-22 23:14:19 +01:00
Matt Caswell
cf1b08cdd7 Revert "Fix off-by-one errors in ssl_cipher_get_evp()" 
This reverts commit abfb989fe0.

Incorrect attribution
 2014-06-22 22:35:56 +01:00
Matt Caswell
339da43d6c Fixed Windows compilation failure 2014-06-22 20:16:47 +02:00
Matt Caswell
115e480924 Fix minor typos 2014-06-19 23:45:21 +01:00
Hubert Kario
e42d84be33 add references to verify(1) man page for args_verify() options 
cms, ocsp, s_client, s_server and smime tools also use args_verify()
for parsing options, that makes them most of the same options
verify tool does. Add those options to man pages and reference
their explanation in the verify man page.
 2014-06-19 23:09:21 +01:00
Hubert Kario
2866441a90 sort the options in verify man page alphabetically 
just making sure the options are listed in the alphabetical order
both in SYNOPSIS and DESCRIPTION, no text changes
 2014-06-19 23:09:21 +01:00
Hubert Kario
cd028c8e66 add description of missing options to verify man page 
The options related to policy used for verification, verification
of subject names in certificate and certificate chain handling
were missing in the verify(1) man page. This fixes this issue.
 2014-06-19 23:09:21 +01:00
Hubert Kario
ce21d108bd smime man page: add missing options in SYNOPSIS 
-CAfile and -CApath is documented in OPTIONS but is missing
in SYNOPSIS, add them there
 2014-06-19 23:09:21 +01:00
Hubert Kario
6d3d579367 Document -trusted_first option in man pages and help. 
Add -trusted_first description to help messages and man pages
of tools that deal with certificate verification.
 2014-06-19 23:09:21 +01:00
Matt Caswell
2d7153e8f9 Tidied up, added include to stdlib, removed "goto bad" usage 2014-06-17 23:35:53 +01:00
rfkrocktk
8a531c22b0 Conform to whitespace conventions 2014-06-17 23:10:14 +01:00
rfkrocktk
96fc4b7250 Added documentation for -iter for PKCS#8 2014-06-17 23:10:14 +01:00
Naftuli Tzvi Kay
8a6c6bbf21 Added custom PBKDF2 iteration count to PKCS8 tool. 2014-06-17 23:10:14 +01:00
Felix Laurie von Massenbach
50cc4f7b3d Fix signed/unsigned comparisons. 2014-06-17 17:41:46 +01:00
Felix Laurie von Massenbach
1f61d8b5b1 Fix shadow declaration. 2014-06-17 17:41:46 +01:00
Andy Polyakov
9024b84b7c aesni-sha[1|256]-x86_64.pl: fix logical error and MacOS X build. 2014-06-16 10:11:45 +02:00
Andy Polyakov
764fe518da aesp8-ppc.pl: add CTR mode. 2014-06-16 08:05:19 +02:00
Viktor Dukhovni
7241a4c7fd Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-only 2014-06-14 22:31:29 +01:00
Dr. Stephen Henson
3b77f01702 Accept CCS after sending finished. 
Allow CCS after finished has been sent by client: at this point
keys have been correctly set up so it is OK to accept CCS from
server. Without this renegotiation can sometimes fail.

PR#3400
 2014-06-14 22:31:28 +01:00
Andy Polyakov
ce00c64df9 evp/e_aes_cbc_sha[1|256].c: fix -DPEDANTIC build. 2014-06-14 23:15:39 +02:00
Andy Polyakov
91a6bf80f8 aesni-sha256-x86_64.pl: add missing rex in shaext. 
PR: 3405
 2014-06-14 16:03:06 +02:00
Andy Polyakov
c9cf29cca2 sha1-x86_64.pl: add missing rex prefix in shaext. 
PR: 3405
 2014-06-14 15:27:54 +02:00
Matt Caswell
687721a7dc Fixed incorrect return code handling in ssl3_final_finish_mac. 
Based on an original patch by Joel Sing (OpenBSD) who also originally identified the issue.
 2014-06-13 15:36:20 +01:00
Matt Caswell
043fd64689 Revert "Fixed incorrect return code handling in ssl3_final_finish_mac" 
This reverts commit 2f1dffa88e.

Missing attribution.
 2014-06-13 15:35:20 +01:00
Viktor Dukhovni
a09e4d24ad Client-side namecheck wildcards. 
A client reference identity of ".example.com" matches a server
certificate presented identity that is any sub-domain of "example.com"
(e.g. "www.sub.example.com).

With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches
only direct child sub-domains (e.g. "www.sub.example.com").
 2014-06-12 23:19:25 +01:00