summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
* fix two remotely triggerable memory leaks.OPENBSD_5_4tedu2014-10-192-1/+4
| | | | tested by jasper
* backport relevant security fixes from openssl 1.0.1itedu2014-08-0914-193/+296
| | | | tested by bcook jsg
* MFC DTLS buffer overflow fix (CVE-2014-0195)sthen2014-06-051-1/+7
| | | | | | "Avoid a buffer overflow that can be triggered by sending specially crafted DTLS fragments. Fix for CVE-2014-0195, from OpenSSL. Reported to OpenSSL by Juri Aedla." From d1_both.c r1.19
* MFC DTLS "Hello Request" fix (CVE-2014-0221)sthen2014-06-051-2/+2
| | | | | | | | "Do not recurse when a 'Hello Request' message is received while getting DTLS fragments. A stream of 'Hello Request' messages will result in infinite recursion, eventually crashing the DTLS client or server. Fixes CVE-2014-0221, from OpenSSL. Reported to OpenSSL by Imre Rad." From d1_both.c r1.20
* MFC sess_cert fix (CVE-2014-3470)sthen2014-06-051-0/+8
| | | | | "Ensure that sess_cert is not NULL before trying to use it. Fixes CVE-2014-3470, from OpenSSL." From s3_clnt.c r1.66
* MFC ChangeCipherSpec fixes (CVE-2014-0224 and additional safeguard), ok jsing@sthen2014-06-054-4/+22
| | | | | | | | | | | | | "Be selective as to when ChangeCipherSpec messages will be accepted. Without this an early ChangeCipherSpec message would result in session keys being generated, along with the Finished hash for the handshake, using an empty master secret." From s3_clnt.c r1.64, s3_pkt.c r1.42, s3_srvr.c r1.59, ssl3.h r1.19 - note that the ssl3.h change has been applied to s3_locl.h instead to simplify patching. "Ensure that we do not process a ChangeCipherSpec with an empty master secret. This is an additional safeguard against early ChangeCipherSpec handling." From s3_pkt.c:1.43
* MFC, requested by deraadt@sthen2014-05-011-0/+4
| | | | | | | | | | | | | | | | | | -/-------------------------- revision 1.33 date: 2014/04/24 04:31:30; author: tedu; state: Exp; lines: +4 -0; on today's episode of things you didn't want to learn: do_ssl3_write() is recursive. and not in the simple, obvious way, but in the sneaky called through ssl3_dispatch_alert way. (alert level: fuchsia) this then has a decent chance of releasing the buffer that we thought we were going to use. check for this happening, and if the buffer has gone missing, put another one back in place. the direct recursive call is safe because it won't call ssl3_write_pending which is the function that actually does do the writing and releasing. as reported by David Ramos to openssl-dev: http://marc.info/?l=openssl-dev&m=139809493725682&w=2 ok beck -/--------------------------
* from head, will become 5.4 008_openssl.patchderaadt2014-04-121-1/+1
| | | | | | | | Changes by: tedu@cvs.openbsd.org 2014/04/10 13:01:37 Piotr Sikora pointed me at a more refined diff for the buffer release issue. Apply that version. Maybe someday upstream will wake up and then we can have the same code. https://rt.openssl.org/Ticket/Display.html?id=2167&user=guest&pass=guest
* MFC:djm2014-04-082-13/+27
| | | | | cherrypick fix for CVE-2014-0160 "heartbleed" vulnerability from OpenSSL git; ok sthen@
* MFC: Reliability fix for SHA384 SSL/TLS ciphers on strict alignmentjca2013-12-201-1/+8
| | | | architectures. ok miod@ djm@
* This commit was manufactured by cvs2git to create branch 'OPENBSD_5_4'.cvs2svn2013-07-22105-52036/+0
|
* Remove no longer needed vax CFLAGS workarounds.miod2013-07-131-13/+1
|
* VAX ELF userland bits. Consists mostly of register prefix additions.miod2013-07-051-151/+151
|
* Switch to using unhyphenated VIA padlock mnemonics. VIA abandoned thematthew2013-05-301-2/+2
| | | | | | | | hyphen in their official programming guide sometime between 2003 and 2005, and Clang's integrated assembler does not support hyphenated mnemonics. ok jsg, deraadt
* cherry pick bugfixes for http://www.openssl.org/news/secadv_20130205.txtmarkus2013-02-1425-515/+2348
| | | | | from the openssl git (changes between openssl 1.0.1c and 1.0.1d). ok djm@
* remove ACSS, crank libcrypto major; ok markus@ deraadt@djm2013-01-269-480/+4
|
* New CA root certificates, ok beck@.sthen2012-12-031-99/+1705
| | | | | | | | | | | | | | - additional cert's from GlobalSign. - additional cert's from VeriSign and replace existing ones with 'Signature Algorithm: md2WithRSAEncryption' with their currently distributed sha1WithRSAEncryption versions. - new CAs: AddTrust (root for most Comodo certificates also heavily used in academic networks), Comodo (most of their certs are rooted in AddTrust but TERENA use the Comodo AAA Certificate Services root for some things so add that separately), UserTrust Network/UTN (part of Comodo) and Starfield (part of Go Daddy).
* Additional CA root certificates: GeoTrust/Equifax, Go Daddy, StartCom, thawte.sthen2012-12-011-0/+1187
| | | | ok beck@ william@ todd@
* Regenerate the text information for all certificates with recent opensslsthen2012-11-301-439/+465
| | | | | | and include sha1 signatures for all certs (some were missing). No certificate changes, this is just for consistency. ok beck@
* Remove retired Thawte/Verisign certificates.sthen2012-11-301-499/+0
| | | | | | Remove intermediate GoDaddy certificate, this file should just contain roots. ok beck@ phessler@
* On amd64 OPENSSL_cpuid_setup and OPENSSL_ia32cap_P are now hidden so we don'tkettenis2012-10-314-9/+5
| | | | | | | | | | have to go through the PLT/GOT to get at them anymore. In fact going through the GOT now fails since we no longer have a GOT entry for OPENSSL_ia32cap_P. Fixes the problem spotted by jasper@ and sthen@. Based on a diff from mikeb@ who did most of the actual work of tracking down the issue. ok millert@, mikeb@
* Restore r1.10, lost during last update:miod2012-10-221-1/+1
| | | | Disable use of dladdr() on a.out arches, they do not provide it (yet);
* Makefile and header changes for OpenSSL-1.0.1cdjm2012-10-1320-139/+361
| | | | major cranks
* import files that CVS missed; sighdjm2012-10-135-0/+749
|
* resolve conflictsdjm2012-10-13309-4740/+23179
|
* This commit was generated by cvs2git to track changes on a CVS vendordjm2012-10-1328-554/+421
|\ | | | | branch.
| * import OpenSSL-1.0.1cdjm2012-10-13290-3994/+14133
| |
* | This commit was generated by cvs2git to track changes on a CVS vendordjm2012-10-13193-1354/+53656
|\ \ | | | | | | branch.
| * | import OpenSSL-1.0.1cdjm2012-10-13218-2281/+58716
| | |
* | | This commit was generated by cvs2git to track changes on a CVS vendordjm2012-10-139-18/+869
|\ \ \ | | | | | | | | branch.
| * | | import OpenSSL-1.0.1cdjm2012-10-1342-501/+5785
| | | |
* | | | When deciding whether we're PIC in a (generated) asm file, check for both PICpascal2012-08-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | and __PIC__ defines. Makes things easier for PIE. ok djm@
* | | | remove leftover NOLINT, WANTLINT, LINTFLAGS, LOBJ vars and lint targets.okan2012-08-022-4/+2
| | | | | | | | | | | | | | | | ok guenther@
* | | | Skip printing another SSLv2-only command in s_client's usage text.sthen2012-07-121-0/+2
| | | | | | | | | | | | | | | | jmc@ noticed this in the manpage while updating it, but it applies here too.
* | | | Disable SSLv2 in OpenSSL. No objections from djm.sthen2012-07-1119-7/+94
| | | | | | | | | | | | | | | | Brad, jasper and naddy helped with test builds, fixing ports, etc.
* | | | cherrypick fix for CVE-2012-2110: libcrypto ASN.1 parsing heap overflowdjm2012-04-193-14/+61
| | | | | | | | | | | | | | | | ok miod@ deraadt@
* | | | OpenSSL 1.0.0f: crank minordjm2012-01-053-3/+3
| | | |
* | | | OpenSSL 1.0.0f: mergedjm2012-01-0551-186/+526
| | | |
* | | | This commit was generated by cvs2git to track changes on a CVS vendordjm2012-01-052-8/+24
|\| | | | | | | | | | | branch.
| * | | OpenSSL 1.0.0f: import upstream sourcedjm2012-01-0516-28/+90
| | | |
* | | | This commit was generated by cvs2git to track changes on a CVS vendordjm2012-01-051-1/+1
|\ \ \ \ | | |_|/ | |/| | branch.
| * | | OpenSSL 1.0.0f: import upstream sourcedjm2012-01-0534-115/+358
| | | |
* | | | This commit was generated by cvs2git to track changes on a CVS vendordjm2012-01-057-17/+114
|\ \ \ \ | | |_|/ | |/| | branch.
| * | | OpenSSL 1.0.0f: import upstream sourcedjm2012-01-0511-69/+217
| | | |
* | | | crank major for openssl-1.0.0edjm2011-11-033-3/+3
| | | |
* | | | openssl-1.0.0e: resolve conflictsdjm2011-11-03180-1657/+3506
| | | |
* | | | This commit was generated by cvs2git to track changes on a CVS vendordjm2011-11-0318-131/+1470
|\ \ \ \ | | |/ / | |/| | branch.
| * | | import OpenSSL 1.0.0edjm2011-11-03166-1620/+4772
| | | |
* | | | This commit was generated by cvs2git to track changes on a CVS vendordjm2011-11-034-76/+117
|\ \ \ \ | | |_|/ | |/| | branch.
| * | | import OpenSSL 1.0.0edjm2011-11-0319-193/+284
| | | |
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-18 02:53:24 +0000