aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix special case in BER decoding of negative integertopic/fix-asn1-integer-decodeKazuki Yamaguchi2017-04-281-0/+18
| | | | | | Leading 0xFF byte cannot be treated as a padding if all the following bytes are 0x00. Restore a branch removed by a3ea6bf0ef70 ("asn1/a_int.c: remove code duplicate and optimize branches,", 2017-04-11).
* Remove (broken) diagnostic printRich Salz2017-04-271-6/+0
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3336)
* fuzz/{client,server}.c: omit _time64 "overload method".Andy Polyakov2017-04-272-16/+12
| | | | | | | | | | | Approach was opportunistic in Windows context from its inception and on top of that it was proven to be error-prone at link stage. Correct answer is to introduce library-specific time function that we can control in platform-neutral manner. Meanwhile we just let be attempts to override time on Windows. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3320)
* Ensure s_client sends an SNI extension by defaultMatt Caswell2017-04-276-18/+58
| | | | | | | | | Enforcement of an SNI extension in the initial ClientHello is becoming increasingly common (e.g. see GitHub issue #2580). This commit changes s_client so that it adds SNI be default, unless explicitly told not to via the new "-noservername" option. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2614)
* Add parentheses on public macros where appropriate.Bernd Edlinger2017-04-2711-147/+168
| | | | | | | Fixes #3063. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3100)
* Remove unnecessary loop in pkey_rsa_decrypt.Bernd Edlinger2017-04-261-7/+2
| | | | | | | | | It is not necessary to remove leading zeros here because RSA_padding_check_PKCS1_OAEP_mgf1 appends them again. As this was not done in constant time, this might have leaked timing information. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3313)
* Fix ISO C function/object pointer issueRich Salz2017-04-261-12/+12
| | | | | | | Showed up on GCC with strict warnings. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3325)
* Convert sslapitest to test frameworkRich Salz2017-04-261-1071/+558
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3252)
* Convert bntest to TEST_ frameworkRich Salz2017-04-262-746/+582
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3265)
* Return success in custom_ext_parse_old_cb_wrap if parse_cb is NULLGraham Edgecombe2017-04-261-0/+3
| | | | | | | | | | | | | | This fixes a segfault if a NULL parse_cb is passed to SSL_CTX_add_{client,server}_custom_ext, which was supported in the pre-1.1.1 implementation. This behaviour is consistent with the other custom_ext_*_old_cb_wrap functions, and with the new SSL_CTX_add_custom_ext function. CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3310)
* Convert dtls_mtu_test, dtlsv1listentestRich Salz2017-04-265-289/+182
| | | | | | | | Also converted most of ssltestlib but left the packet_dump output as-is (for now). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3257)
* Fix no-ecDr. Stephen Henson2017-04-261-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3321)
* Don't treat PACKET_remaining() as booleanTatsuhiro Tsujikawa2017-04-262-6/+6
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3244)
* Break before && operatorTatsuhiro Tsujikawa2017-04-261-5/+5
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3244)
* Call init and finalization functions per extension messageTatsuhiro Tsujikawa2017-04-264-46/+56
| | | | | | | | | | Previously, init and finalization function for extensions are called per extension block, rather than per message. This commit changes that behaviour, and now they are called per message. The parse function is still called per extension block. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3244)
* Clarify that SSL_CTX_remove_session() marks a session as non-resumableMatt Caswell2017-04-262-3/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* More SSL_SESSION documentation tweaks based on feedbackMatt Caswell2017-04-262-3/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Tweak SSL_get_session.pod wordingMatt Caswell2017-04-261-13/+13
| | | | | | Based on feedback received. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Always duplicate the session on NewSessionTicket in TLSv1.3Matt Caswell2017-04-261-1/+9
| | | | | | | | Because NST messages arrive post-handshake, the session may have already gone into the cache. Once in the cache a session must be immutable - otherwise you could get multi-thread issues. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Documentation updates for TLSv1.3 sessionsMatt Caswell2017-04-263-2/+75
| | | | | | | Add documentation for SSL_SESSION_is_resumable(). Also describe the interaction of the various session functions and TLSv1.3 post-handshake sessions. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Add support for SSL_SESSION_is_resumable()Matt Caswell2017-04-264-13/+21
| | | | | | | Provide a way to test whether the SSL_SESSION object can be used to resume a sesion or not. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Remove TLS1.3 TODO around testing for session id lengthMatt Caswell2017-04-261-1/+0
| | | | | | | | TLSv1.3 will do the same thing as TLSv1.2 with tickets with regards to session ids, i.e. it will create a synthetic session id when the session is established, so it is reasonable to check the session id length, even in TLSv1.3. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Fix unit-tests when no-srp configuredRich Salz2017-04-261-10/+7
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3274)
* Convert modular exponentiation tests to new frameworkRich Salz2017-04-262-161/+110
| | | | | | | | | | Updated due to test framework changes Updates after code review Missed some checks Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3269)
* Add tests for version/ciphersuite sanity checksMatt Caswell2017-04-261-0/+31
| | | | | | | | The previous commits added sanity checks for where the max enabled protocol version does not have any configured ciphersuites. We should check that we fail in those circumstances. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3316)
* Add a ciphersuite config sanity check for serversMatt Caswell2017-04-268-84/+124
| | | | | | | Ensure that there are ciphersuites enabled for the maximum supported version we will accept in a ClientHello. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3316)
* Add a ciphersuite config sanity check for clientsMatt Caswell2017-04-269-15/+69
| | | | | | | Ensure that there are ciphersuites enabled for the maximum supported version we are claiming in the ClientHello. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3316)
* Don't overwrite the alert value if there is no alert to sendMatt Caswell2017-04-261-21/+21
| | | | | | | | | | | | The function tls_early_post_process_client_hello() was overwriting the passed "al" parameter even if it was successful. The caller of that function, tls_post_process_client_hello(), sets "al" to a sensible default (HANDSHAKE_FAILURE), but this was being overwritten to be INTERNAL_ERROR. The result is a "no shared cipher" error (and probably other similar errors) were being reported back to the client with an incorrect INTERNAL_ERROR alert. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3314)
* evp_test.c: Add PrivPubKeyPair testsRich Salz2017-04-252-0/+1919
| | | | | | Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3245)
* test: don't make it more complicated than necessary.Andy Polyakov2017-04-252-31/+11
| | | | | | | | | | | | | Original rationale behind using write in testutil was to accommodate no-stdio builds. But is there evidence that no-stdio users would have write or pre-defined meaning for file descriptors 1 and 2? Correct answer is to provide way for no-stdio users who want to exercise tests to plug in own BIO, not to make assumption that they have write. And since we don't have to make such assumption, we can as well go for simplest that works with standard library as specified by C language standard. Reviewed-by: Richard Levitte <levitte@openssl.org>
* make updateDr. Stephen Henson2017-04-251-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Update documentationDr. Stephen Henson2017-04-251-1/+32
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Add PSS certificate signature testsDr. Stephen Henson2017-04-251-1/+13
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Add certificates with PSS signaturesDr. Stephen Henson2017-04-253-0/+48
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Add custom sig_info setting for RSA-PSSDr. Stephen Henson2017-04-251-1/+38
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Use X509_get_signature_info() when checking security levels.Dr. Stephen Henson2017-04-251-10/+2
| | | | | | | | Make signature security level checking more flexible by using X509_get_signaure_info(): some signature methods (e.g. PSS, ED25519) do not indicate the signing digest (if any) in the signature OID. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Add support for custom signature parametersDr. Stephen Henson2017-04-257-0/+116
| | | | | | | | | | | | | | | | | | Many signature types define the digest and public key type by a single OID such as ecdsa_with_sha256. Some types (RSA-PSS for example) use a single OID to indicate the signature scheme and additional parameters are encoded in the AlgorithmIdentifier. Add an X509_SIG_INFO structure to contain details about the signature type: specifically the digest algorithm, public key algorithm, security bits and various flags. This supports both existing algorithms and more complex types. Add accessors for the structure and a special case that retrieves signature information from a certificate. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Tapify libtestutil a bit betterRichard Levitte2017-04-251-1/+14
| | | | | | | | This includes better signals of skips and subtests according to TAP 12, and flushing stdout and stderr at the end of every test function to make sure we get the output in good order. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3309)
* Add include path '..' for libtestutilRichard Levitte2017-04-251-1/+1
| | | | | | Since it uses some of the apps/ stuff and some of them include e_os.h... Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3307)
* Switch command-line utils to new nameopt API.Dmitry Belyavskiy2017-04-2518-105/+142
| | | | | | | | | | | | | | | | | The CA names should be printed according to user's decision print_name instead of set of BIO_printf dump_cert_text instead of set of BIO_printf Testing cyrillic output of X509_CRL_print_ex Write and use X509_CRL_print_ex Reduce usage of X509_NAME_online Using X509_REQ_print_ex instead of X509_REQ_print Fix nameopt processing. Make dump_cert_text nameopt-friendly Move nameopt getter/setter to apps/apps.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3262)
* Ignore all .a files, not just the top onesRichard Levitte2017-04-251-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add documentation for the -sctp option in command line appsMatt Caswell2017-04-252-0/+14
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3305)
* Correct some badly formated preprocessor linesRichard Levitte2017-04-253-8/+8
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3304)
* Add guards around one of use of IPPROTO_SCTP where it was missingRichard Levitte2017-04-251-0/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3304)
* TAPify testutilRichard Levitte2017-04-255-25/+83
| | | | | | | | | | | | | | | With the perl test framework comes the output format TAP (Test Anything Protocol, see http://testanything.org/) with extra extension for subtests. This change extends that same output format to any test program using testutil. In this implementation, each test program is seen as a full test that can be used as a subtest. The perl framework passes on the subtest level to the test programs with the environment variable HARNESS_OSSL_LEVEL. Furthermore, and series of tests added with ADD_ALL_TESTS is regarded as another subtest level. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3296)
* openssl enc: Don't unbuffer stdinBernard Spil2017-04-251-1/+0
| | | | | | | | | | - unbuffer causes single-byte reads from stdin and poor performance Fixes #3281 CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3299)
* Fix doc-nits issueMatt Caswell2017-04-251-0/+1
| | | | | | BIO_lookup_ex() should be in the NAME section Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Address review feedback for the SCTP changesMatt Caswell2017-04-253-2/+15
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Fix issue in 18-dtls-renegotiate.conf.inMatt Caswell2017-04-252-1/+10
| | | | | | Don't skip all tests if SCTP is disabled! Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Document BIO_lookup_ex()Matt Caswell2017-04-253-12/+25
| | | | | | We also change the enum type to an int. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-29 00:04:42 +0000