aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Remove ECDH(E) ciphers from SSLv3Todd Short2017-04-111-20/+20
| | | | | | | | | | SSLv3 does not support TLS extensions, and thus, cannot provide any curves for ECDH(E). With the removal of the default (all) list of curves being used for connections that didn't provide any curves, ECDHE is no longer possible. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3181)
* Additional check to handle BAD SSL_write retryRich Salz2017-04-111-1/+2
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3124)
* Reject decoding of an INT64 with a value >INT64_MAXMatt Caswell2017-04-112-1/+6
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3159)
* Update dtlstest to use the test infrastructurePauli2017-04-111-25/+12
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3170)
* Update md2test to use the test infrastructurePauli2017-04-112-46/+21
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3165)
* Update rc2test to use the test infrastructurePauli2017-04-102-53/+22
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3161)
* Make test marcos for true/false checks reliable for all integral types.Pauli2017-04-101-2/+2
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3154)
* Allow an ALPN callback to pretend to not existBenjamin Kaduk2017-04-103-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 7301 mandates that the server SHALL respond with a fatal "no_application_protocol" alert when there is no overlap between the client's supplied list and the server's list of supported protocols. In commit 062178678f5374b09f00d70796f6e692e8775aca we changed from ignoring non-success returns from the supplied alpn_select_cb() to treating such non-success returns as indicative of non-overlap and sending the fatal alert. In effect, this is using the presence of an alpn_select_cb() as a proxy to attempt to determine whether the application has configured a list of supported protocols. However, there may be cases in which an application's architecture leads it to supply an alpn_select_cb() but have that callback be configured to take no action on connections that do not have ALPN configured; returning SSL_TLSEXT_ERR_NOACK from the callback would be the natural way to do so. Unfortunately, the aforementioned behavior change also treated SSL_TLSEXT_ERR_NOACK as indicative of no overlap and terminated the connection; this change supplies special handling for SSL_TLSEXT_ERR_NOACK returns from the callback. In effect, it provides a way for a callback to obtain the behavior that would have occurred if no callback was registered at all, which was not possible prior to this change. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2570)
* Fix util/mkdef.plRichard Levitte2017-04-101-18/+10
| | | | | | | | | | The deprecation checking code here didn't work the same way as in Configure, and used $config{options} to find an --api= option that was never there. This is replaced with checking $config{api}, which is the controlling variable for deprecation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Add a note in CHANGESRichard Levitte2017-04-101-0/+6
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Act on deprecation of LONG and ZLONG, step 3Richard Levitte2017-04-102-5/+25
| | | | | | | | | | | | | | | Teach util/mkdef.pl to recognise these lines: #if OPENSSL_API_COMPAT < 0xXXXXXXXXL #if OPENSSL_API_COMPAT >= 0xXXXXXXXXL and add corresponding markers in util/*.num A final 'make update' sets those markers right for LONG and ZLONG. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Act on deprecation of LONG and ZLONG, step 2Richard Levitte2017-04-1011-48/+48
| | | | | | | Replace all remaining uses of LONG and ZLONG with INT32 / ZINT32. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Act on deprecation of LONG and ZLONG, step 1Richard Levitte2017-04-103-0/+14
| | | | | | | Don't compile code that still uses LONG when it's deprecated Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Discourage the use of LONG and ZLONG, and deprecate it in the futureRichard Levitte2017-04-102-0/+12
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Publish our INT32, UINT32, INT64, UINT64 ASN.1 types and Z variantsRichard Levitte2017-04-108-23/+27
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* rand/rand_lib.c: keep fixing no-engine configuration.Andy Polyakov2017-04-101-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* asn1/x_long.c: remove conditions in inner loops and dependency on BN.Andy Polyakov2017-04-101-26/+47
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3152)
* appveyor.yml: split {build,test}_scripts to avoid exit code masking.Andy Polyakov2017-04-081-6/+9
| | | | | | | Last modification effectively masked test failures, so that builds were reported successful even if they failed. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use 'over 2' for bullet lists.Rich Salz2017-04-0712-49/+112
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Standardize on =over 4 and check for it.Rich Salz2017-04-0715-29/+30
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Add missing =backRich Salz2017-04-071-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Check for L<foo|foo>Rich Salz2017-04-071-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Make default_method mostly compile-time (cont'd)Rich Salz2017-04-071-5/+5
| | | | | | | Forgot to include this commit as requested by review. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2244)
* Make default_method mostly compile-timeRich Salz2017-04-0720-208/+87
| | | | | | | | Document thread-safety issues Have RSA_null return NULL (always fails) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2244)
* Fix rand_lib.c for no-engine configurationRichard Levitte2017-04-071-1/+4
| | | | | | | When configured no-engine, we still refered to rand_engine_lock. Rework the lock init code to avoid that. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3145)
* Fix a test failure when configured without TLSv1.3Matt Caswell2017-04-071-0/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Remove an out of date TODOMatt Caswell2017-04-071-5/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Create an ENDPOINT enum type for use internallyMatt Caswell2017-04-074-33/+41
| | | | | | We need it for the custom extensions API Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Prefix custom extension API callback types with SSL_Matt Caswell2017-04-074-46/+52
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Various style tweaks based on feedbackMatt Caswell2017-04-072-30/+30
| | | | | | Style updates for the new custom extensions API Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Add documentation for the new custom extensions APIMatt Caswell2017-04-071-48/+191
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Add some tests for the new custom extensions APIMatt Caswell2017-04-071-0/+308
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Implement a new custom extensions APIMatt Caswell2017-04-079-202/+440
| | | | | | | | The old custom extensions API was not TLSv1.3 aware. Extensions are used extensively in TLSv1.3 and they can appear in many different types of messages. Therefore we need a new API to be able to cope with that. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Move the extensions context codes into the public APIMatt Caswell2017-04-079-119/+135
| | | | | | | | This move prepares for the later addition of the new custom extensions API. The context codes have an additional "SSL_" added to their name to ensure we don't have name clashes with other applications. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Move ssl/t1_ext.c to ssl/statem/extensions_cust.cMatt Caswell2017-04-072-3/+3
| | | | | | Brings all the extensions code together. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Don't try to clean up RAND from ENGINERichard Levitte2017-04-071-5/+0
| | | | | | | This is especially harmful since OPENSSL_cleanup() has already called the RAND cleanup function Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3137)
* Make getting and setting the RAND default method thread safeRichard Levitte2017-04-071-2/+35
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3137)
* e_os2.h: Refine OSSL_SSIZE definition under UEFI environmentQin Long2017-04-061-3/+3
| | | | | | | | | | | | | | | Under UEFI build environment, we may encounter the OSSL_SSIZE macro re-definition error in e_os2.h if any module call OpenSSL API directly by including "openssl/xxxx.h" (caused by the predefined _WIN32/_WIN64 macro, which should have been un-defined under OPENSSL_SYS_UEFI). Though it's not one recommended usage, this patch could still eliminate the possible build issue by refining the OSSL_SSIZE definition under OPENSSL_SYS_UEFI. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3121)
* Add support for MLOCK_ONFAULT to secure arenaTodd Short2017-04-061-0/+16
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3115)
* In rand_cleanup_int(), don't go creating a default methodRichard Levitte2017-04-061-1/+1
| | | | | | | | | | | | | If no default method was yet given, RAND_get_rand_method() will set it up. Doing so just to clean it away seems pretty silly, so instead, use the default_RAND_meth variable directly. This also clears a possible race condition where this will try to init things, such as ERR or ENGINE when in the middle of a OPENSSL_cleanup. Fixes #3128 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3136)
* Fix test/asn1_encode_test.c, ASN1_LONG_DATA used inappropriatelyRichard Levitte2017-04-051-4/+4
| | | | | | | It's sheer luck that this was used for the first field only which also has the same type in all data structures, so the offsets were never wrong Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3127)
* Configurations/README: reword bn_ops description.Andy Polyakov2017-04-041-24/+28
| | | | | | Fixes GH#3116. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Configure: recognize -framework as linker option [on Apple OSes].Andy Polyakov2017-04-041-0/+4
| | | | | | | This is handy for internal iOS tests, when you have to make it work in sandbox. Reviewed-by: Richard Levitte <levitte@openssl.org>
* PBKDF2 computation speedup (15-40%)Gergely Nagy2017-04-042-11/+14
| | | | | | | | | | This commit contains some optimizations in PKCS5_PBKDF2_HMAC() and HMAC_CTX_copy() functions which together makes PBKDF2 computations faster by 15-40% according to my measurements made on x64 Linux with both asm optimized and no-asm versions of SHA1, SHA256 and SHA512. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1708)
* Fix faulty check of padding in x_long.cRichard Levitte2017-04-041-2/+5
| | | | | | | | Bug uncovered by test [extended tests] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* Fix a possible integer overflow in long_c2iMatt Caswell2017-04-041-0/+4
| | | | | | | Credit to OSS-Fuzz for finding this. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* Add a test of encoding and decoding LONG, INT32, UINT32, INT64 and UINT64Richard Levitte2017-04-043-1/+735
| | | | | | Also Z varieties. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* Convert SSL_SESSION_ASN1 to use size specific integersRichard Levitte2017-04-041-19/+19
| | | | | | | | | This increases portability of SSL_SESSION files between architectures where the size of |long| may vary. Before this, SSL_SESSION files produced on a 64-bit long architecture may break on a 32-bit long architecture. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* make updateRichard Levitte2017-04-043-1/+23
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* Implement internal ASN.1 types INT32, UINT32, INT64, UINT64Richard Levitte2017-04-046-3/+269
| | | | | | Also Z varieties. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-03 06:50:18 +0000