openbsd/src/lib/libssl, branch OPENBSD_4_8

MFC:

2011-02-11T03:24:29+00:00

---------------------------- revision 1.8 date: 2011/02/10 22:40:27; author: djm; state: Exp; lines: +7 -1 fix for CVE-2011-0014 "OCSP stapling vulnerability"; ok markus@ jasper@ miod@ AFAIK nothing in base uses this, though apache2 from ports may be affected. ----------------------------

Security fix for CVE-2010-4180 as mentioned in http://www.openssl.org/news/secadv_20101202.txt.

2010-12-15T09:43:55+00:00

where clients could modify the stored session cache ciphersuite and in some cases even downgrade the suite to weaker ones. This code is not enabled by default. ok djm@

- Apply security fix for CVE-2010-3864.

2010-11-17T19:12:57+00:00

ok djm@ deraadt@

This commit was manufactured by cvs2git to create branch 'OPENBSD_4_8'.

2010-07-28T09:00:22+00:00

oops. Missed this from my aes-ni commit.

2010-07-01T17:44:57+00:00

AES-NI engine support for OpenSSL.

2010-07-01T17:44:20+00:00

This is code mostly picked up from upstream OpenSSL, or to be more exact a diff from David Woodhouse . Remember to make includes before doing a build! no objections from djm@ OK deraadt@, reyk@ (AES is about 4.25x faster on his x201 now)

VIA xcrypt for amd64, simpler version of a diff from deraadt

2010-06-29T01:46:19+00:00

with suggestions from miod. The codepath doesn't seem to be called yet, this will be investigated later. looks good miod@, ok deraadt@

Add the extendedKeyUsage flags serverAuth and clientAuth. Newer Windows

2010-06-26T18:42:02+00:00

version require these flags to accept the X.509 certificates from the gateway or client; I just add both flags to make it work in both cases and verified it with win7, for example when authenticating against iked. go ahead beck@

When running in pic mode we don't have enough general registers for all

2010-05-03T07:22:07+00:00

the xcrypt inputs, hence the dance which is done to make this work. The constraint for the key however was "mr" which is both from memory and from a general register, it seems gcc3 went with the former and gcc4 went with the later in the pic case, so change the constraint for the key to just "m" which gives us more efficient code that both gcc3 and gcc4 are happy with. ok kettenis@

The openssl command line tool treats the non-null terminated buffer

2010-04-20T23:01:28+00:00

"mbuf" as a C string when using the pop3 s_client feature. This causes a segmentation fault with malloc.conf option "J" set when BIO_printf() runs off the end of the buffer. The following patch fixes PR 6282 from Matthew Haub (asked to submit upstream), ok djm