aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2017-09-08Add UI functions to set result with explicit length and to retrieve the lengthRichard Levitte10-17/+89
This allows completely arbitrary passphrases to be entered, including NUL bytes. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3821)
2017-09-08Document default section and library configurationxemdetia1-1/+4
It is talked around but not explicitly stated in one part of the documentation that you should put library configuration lines at the start of the configuration file. CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3959)
2017-09-08Allow an endpoint to read the alert data before closing the socketMatt Caswell1-0/+17
If an alert gets sent and then we close the connection immediately with data still in the input buffer then a TCP-RST gets sent. Some OSs immediately abandon data in their input buffer if a TCP-RST is received - meaning the alert data itself gets ditched. Sending a TCP-FIN before the TCP-RST seems to avoid this. This was causing test failures in MSYS2 builds. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4333)
2017-09-07Fix error handling/cleanupRich Salz1-13/+5
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4326)
2017-09-07Fix test_client_hello with no-tls1_2_methodBenjamin Kaduk1-2/+3
The extensions not sent when TLS 1.2 is not used caused the message length to be 109, which is less than the 127 threshold needed to activate the F5 workaround. Add another 20 bytes of dummy ALPN data do push it over the threshold. Also, fix the definition of the (unused) local macro indicating the threshold. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4346)
2017-09-07Restore historical behavior for absent ServerHello extensionsBenjamin Kaduk1-2/+2
In OpenSSL 1.1.0, when there were no extensions added to the ServerHello, we did not write the extension data length bytes to the end of the ServerHello; this is needed for compatibility with old client implementations that do not support TLS extensions (such as the default configuration of OpenSSL 0.9.8). When ServerHello extension construction was converted to the new extensions framework in commit 7da160b0f46d832dbf285cb0b48ae56d4a8b884d, this behavior was inadvertently limited to cases when SSLv3 was negotiated (and similarly for ClientHellos), presumably since extensions are not defined at all for SSLv3. However, extensions for TLS prior to TLS 1.3 have been defined in separate RFCs (6066, 4366, and 3546) from the TLS protocol specifications, and as such should be considered an optional protocol feature in those cases. Accordingly, be conservative in what we send, and skip the extensions block when there are no extensions to be sent, regardless of the TLS/SSL version. (TLS 1.3 requires extensions and can safely be treated differently.) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4296)
2017-09-06Add checks for alloc failing.Rich Salz2-2/+4
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4341)
2017-09-06add callback handler for setting DTLS timer intervalAlfred E. Heggestad7-9/+114
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4011)
2017-09-05Fix OSSL_STORE's 'file' loader: make sure peekbuf is initialisedRichard Levitte1-1/+1
This quiets down complaints about the use of uninitialised memory [extended tests] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4340)
2017-09-04Don't use ciphersuites for inflating the ClientHello in clienthellotestMatt Caswell1-7/+5
clienthellotest tries to fill out the size of the ClientHello by adding extra ciphersuites in order to test the padding extension. This is unreliable because they are very dependent on configuration options. If we add too much data the test will fail! We were already also adding some dummy ALPN protocols to pad out the size, and it turns out that this is sufficient just in itself, so drop the extra ciphersuites. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4331)
2017-09-04Don't attempt to add a zero length padding extensionMatt Caswell1-1/+1
The padding extension should always be at least 1 byte long Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4331)
2017-09-04Fix 90-test_store.t: using config() requires OpenSSL::Test::UtilsRichard Levitte1-0/+1
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4332)
2017-09-04Fix an include location problem in the extrended tests.Pauli3-4/+4
[extended tests] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4327)
2017-09-03OSSL_STORE: Avoid testing with URIs on the mingw command lineRichard Levitte1-25/+79
Some URIs get "mistreated" (converted) by the MSYS run-time. Unfortunately, avoiding this conversion doesn't help either. http://www.mingw.org/wiki/Posix_path_conversion Fixes #4314 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4322)
2017-09-02Fix doc-nits from previous commitRich Salz3-2/+4
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4325)
2017-09-02config: get "stty technique" working again on MacOS X.Andy Polyakov1-3/+1
Addresses GH#2167. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4311)
2017-09-02test/run_tests.pl: don't use Module::Load::Conditional.Andy Polyakov1-3/+2
Ironically enough not all installations get Module::Load::Conditional installed by default... [It's a bit half-hearted, because such installations are likely to lack more stuffi that is needed, but nevertheless, it proved to be helpful.] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4323)
2017-09-02Less documentation for deprecated APIRich Salz15-174/+103
Deprecated functions are still documented. Put HISTORY after SEE ALSO; add HISTORY to BN_zero Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3746)
2017-09-01Fix OpenSSL::Test::Utils::config to actualy load the config dataRichard Levitte1-0/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4319)
2017-09-01Fix long SNI lengths in test/handshake_helper.cBenjamin Kaduk1-2/+2
If the server_name extension is long enough to require two bytes to hold the length of either field, the test suite would not decode the length properly. Using the PACKET_ APIs would have avoided this, but it was desired to avoid using private APIs in this part of the test suite, to keep ourselves honest. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4318)
2017-09-01Fixup include path in ossl_shim test after e_os.h workBenjamin Kaduk1-1/+1
The include search path was not picking up files in the root of the tree. [extended tests] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4316)
2017-09-01Tighten up SSL_get1_supported_ciphers() docsBenjamin Kaduk1-6/+6
This function is really emulating what would happen in client mode, and does not necessarily reflect what is usable for a server SSL. Make this a bit more explicit, and do some wordsmithing while here. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4284)
2017-09-01Fix Proxy where a timeout occurs waiting for both client and serverMatt Caswell1-3/+6
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4305)
2017-09-01crypto/cryptlib.c: mask more capability bits upon FXSR bit flip.Andy Polyakov2-7/+21
OPENSSL_ia32cap.pod discusses possibility to disable operations on XMM register bank. This formally means that this flag has to be checked in combination with other flags. But it customarily isn't. But instead of chasing all the cases we can flip more bits together with FXSR one. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4303)
2017-09-01ssl/statem/extensions_clnt.c: fix return code buglet.Andy Polyakov1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4297)
2017-09-01ssl/statem/*.c: address "enum mixed with another type" warnings.Andy Polyakov4-9/+12
This is actually not all warnings, only return values. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4297)
2017-09-01struct timeval include guardsPauli7-35/+14
Move struct timeval includes into e_os.h (where the Windows ones were). Enaure that the include is guarded canonically. Refer #4271 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4312)
2017-08-31Address feedbackRich Salz1-25/+35
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4294)
2017-08-31Add CRYPTO_thread_glock_newRich Salz14-19/+91
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4294)
2017-09-01Fix potential null problem.Pauli1-2/+2
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4313)
2017-08-31Avoid possible uninitialized variable.Rich Salz1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4307)
2017-08-31OpenSSL::Test::__fixup_prg: don't check program existenceRichard Levitte1-5/+0
The program will fail to run if it doesn't exist anyway, no need to check its existence here. Fixes #4306 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4309)
2017-08-31util/mkdef.pl: handle line terminators correctlyRichard Levitte1-2/+1
When parsing the header files, mkdef.pl didn't clear the line terminator properly. In most cases, this didn't matter, but there were moments when this caused parsing errors (such as CRLFs in certain cases). Fixes #4267 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4304)
2017-08-31Various review fixes for PSK early_data supportMatt Caswell5-11/+17
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Test for late client side detection of ALPN inconsistentiesMatt Caswell1-56/+111
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Client side sanity check of ALPN after server has accepted early_dataMatt Caswell3-19/+61
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add some fixes for Travis failuresMatt Caswell2-3/+3
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add PSK early_data testsMatt Caswell1-0/+171
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add server side sanity checks of SNI/ALPN for use with early_dataMatt Caswell4-14/+53
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Make sure we save ALPN data in the sessionMatt Caswell1-0/+11
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Complain if we are writing early data but SNI or ALPN is incorrectMatt Caswell4-4/+56
SNI and ALPN must be set to be consistent with the PSK. Otherwise this is an error. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add functions for getting/setting SNI/ALPN info in SSL_SESSIONMatt Caswell4-2/+78
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Show the error stack if there was an error writing early data in s_clientMatt Caswell1-0/+1
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Update the tests for SNI changesMatt Caswell4-8/+13
If there is no SNI in the session then s_client no longer sends the SNI extension. Update the tests to take account of that Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31If no SNI has been explicitly set use the one from the sessionMatt Caswell1-0/+20
If we have not decided on an SNI value yet, but we are attempting to reuse a session, and SNI is set in that, then we should use that value by default. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Make sure we use the correct cipher when using the early_secretMatt Caswell1-2/+18
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add HISTORY and SEE ALSO sections for the new TLSv1.3 PSK functionsMatt Caswell2-0/+20
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add documentation for SSL_SESSION_set_max_early_data()Matt Caswell2-2/+13
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add some PSK early_data testsMatt Caswell1-94/+149
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
2017-08-31Add SSL_SESSION_set_max_early_data()Matt Caswell3-0/+10
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3926)
generated by cgit v1.1 at 2024-08-11 06:38:16 +0000