summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* remove FIPS_*_SIZE_TDr. Stephen Henson2014-12-082-8/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove FIPS module code from crypto/evpDr. Stephen Henson2014-12-088-47/+23
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove FIPS module code from crypto/bnDr. Stephen Henson2014-12-081-8/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove FIPS module code from crypto/ecdhDr. Stephen Henson2014-12-081-8/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove FIPS module code from crypto/ecdsaDr. Stephen Henson2014-12-083-129/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove FIPS module code from crypto/dhDr. Stephen Henson2014-12-083-49/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove FIPS module code from crypto/dsaDr. Stephen Henson2014-12-084-198/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove FIPS module code from crypto/rsaDr. Stephen Henson2014-12-084-236/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove FIPS error library from openssl.ec mkerr.plDr. Stephen Henson2014-12-082-3/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* make dependDr. Stephen Henson2014-12-081-113/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove fips.h reference.Dr. Stephen Henson2014-12-081-1/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove fips_constseg references.Dr. Stephen Henson2014-12-0818-114/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove another FIPSCANISTER referenceDr. Stephen Henson2014-12-081-10/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove unnecessary OPENSSL_FIPS referenceDr. Stephen Henson2014-12-081-3/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove OPENSSL_FIPSCANISTER code.Dr. Stephen Henson2014-12-087-58/+0
| | | | | | | OPENSSL_FIPSCANISTER is only set if the fips module is being built (as opposed to being used). Since the fips module wont be built in master this is redundant. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove FIPSCANISTERINTERNAL reference.Dr. Stephen Henson2014-12-081-1/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove fips utility build rules from test/MakefileDr. Stephen Henson2014-12-081-104/+2
| | | | | | The fips test utilities are only build if an FIPS module is being built from source. As this isn't done in master these are redundant. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove fipscanister build functionality from makefiles.Dr. Stephen Henson2014-12-0856-82/+62
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove fipscanister from Configure, delete fips directoryDr. Stephen Henson2014-12-0887-37786/+4
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove some unnecessary OPENSSL_FIPS referencesDr. Stephen Henson2014-12-089-33/+0
| | | | | | FIPS_mode() exists in all versions of OpenSSL but always returns 0 if OpenSSL is not FIPS capable. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add CHANGES entry for OCBMatt Caswell2014-12-081-0/+5
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Added OPENSSL_NO_OCB guardsMatt Caswell2014-12-087-6/+35
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for OCB modeMatt Caswell2014-12-081-13/+31
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add tests for OCB modeMatt Caswell2014-12-082-11/+45
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add EVP support for OCB modeMatt Caswell2014-12-088-3/+463
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add support for OCB mode as per RFC7253Matt Caswell2014-12-084-2/+656
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Clarify the return values for SSL_get_shared_curve.Emilia Kasper2014-12-052-14/+22
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add extra checks for odd-length EC curve lists.Emilia Kasper2014-12-053-74/+111
| | | | | | | | | Odd-length lists should be rejected everywhere upon parsing. Nevertheless, be extra careful and add guards against off-by-one reads. Also, drive-by replace inexplicable double-negation with an explicit comparison. Reviewed-by: Matt Caswell <matt@openssl.org>
* Reject elliptic curve lists of odd lengths.Emilia Kasper2014-12-051-1/+3
| | | | | | | | | | | | The Supported Elliptic Curves extension contains a vector of NamedCurves of 2 bytes each, so the total length must be even. Accepting odd-length lists was observed to lead to a non-exploitable one-byte out-of-bounds read in the latest development branches (1.0.2 and master). Released versions of OpenSSL are not affected. Thanks to Felix Groebert of the Google Security Team for reporting this issue. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix broken buildEmilia Kasper2014-12-054-3/+4
| | | | | | Add includes missing from commit 33eab3f6af51c6d7fe68ee4960930df4f1616bd5 Reviewed-by: Geoff Thorpe <geoff@openssl.org>
* Replace GOST_R_MALLOC_FAILURE and GOST_R_NO_MEMORY with ERR_R_MALLOC_FAILUREKurt Roeckx2014-12-046-13/+9
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* capi_get_provname: Check return valuesKurt Roeckx2014-12-041-6/+12
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* ssl_create_cipher_list: check whether push onto cipherstack succeedsJonas Maebe2014-12-041-1/+6
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* ssl_cert_dup: Fix memory leakJonas Maebe2014-12-041-22/+2
| | | | | | | | Always use goto err on failure and call ssl_cert_free() on the error path so all fields and "ret" itself are freed Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* dtls1_new: free s on error pathKurt Roeckx2014-12-041-4/+9
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* dtls1_heartbeat: check for NULL after allocating s->cert->ctypesJonas Maebe2014-12-041-0/+5
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* dtls1_process_heartbeat: check for NULL after allocating bufferJonas Maebe2014-12-041-0/+2
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* capi_get_key: check for NULL after allocating keyJonas Maebe2014-12-041-0/+2
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* capi_cert_get_fname: check for NULL after allocating wfnameJonas Maebe2014-12-041-0/+2
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* capi_get_provname: free name on error if it was malloc'edJonas Maebe2014-12-041-0/+2
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* pkey_gost_mac_keygen: check for NULL after allocating keydataJonas Maebe2014-12-041-0/+2
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* pkey_gost_ctrl: check for NULL after allocating pctx->shared_ukmJonas Maebe2014-12-041-0/+5
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update changes to indicate that SSLv2 support has been removedKurt Roeckx2014-12-041-0/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove incorrect code inadvertently introduced through commit 59669b6ab.Matt Caswell2014-12-041-4/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove SSLv2 supportKurt Roeckx2014-12-0469-5569/+229
| | | | | | The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: Richard Levitte <levitte@openssl.org>
* New location on website for binaries.Rich Salz2014-12-031-1/+1
| | | | Reviewed-by: Bodo Moeller <bodo@openssl.org>
* Remove "#if 0" codeMatt Caswell2014-12-031-22/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Only use the fallback mtu after 2 unsuccessful retransmissions if it is lessMatt Caswell2014-12-031-1/+5
| | | | | | than the mtu we are already using Reviewed-by: Tim Hudson <tjh@openssl.org>
* Updates to s_client and s_server to remove the constant 28 (for IPv4 headerMatt Caswell2014-12-032-4/+30
| | | | | | | and UDP header) when setting an mtu. This constant is not always correct (e.g. if using IPv6). Use the new DTLS_CTRL functions instead. Reviewed-by: Tim Hudson <tjh@openssl.org>
* If we really get a situation where the underlying mtu is less than the minimumMatt Caswell2014-12-031-1/+4
| | | | | | | we will support then dtls1_do_write can go into an infinite loop. This commit fixes that. Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-05 14:19:59 +0100