aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
...
* Use minimum and maximum protocol version instead of version fixed methodsKurt Roeckx2016-03-094-53/+74
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
* Constify security callbacksKurt Roeckx2016-03-091-2/+2
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Documentation for ctx_set_ctlog_list_file()Rob Percival2016-03-091-0/+6
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Minor improvement to formatting of SCT output in s_clientRob Percival2016-03-091-5/+10
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Do not display a CT log error message if CT validation is disabledRob Percival2016-03-092-7/+13
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Treat boolean functions as booleansRob Percival2016-03-091-1/+1
| | | | | | | | Use "!x" instead of "x <= 0", as these functions never return a negative value. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Extensive application of __owur to CT functions that return a booleanRob Percival2016-03-091-3/+4
| | | | | | | Also improves some documentation of those functions. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove the old threading APIMatt Caswell2016-03-091-50/+0
| | | | | | | | | | All OpenSSL code has now been transferred to use the new threading API, so the old one is no longer used and can be removed. We provide some compat macros for removed functions which are all no-ops. There is now no longer a need to set locking callbacks!! Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix names of the #define used for platform specific codeAndrea Grandi2016-03-081-2/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add empty line after local variablesAndrea Grandi2016-03-081-0/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix error with wait set of fds for the select()Andrea Grandi2016-03-081-75/+24
| | | | | | | It also makes the call to select blocking to reduce CPU usage Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix cert leaks in s_serverFdaSilvaYY2016-03-081-3/+6
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-084-8/+8
| | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Don't free NCONF obtained valuesViktor Dukhovni2016-03-071-9/+15
| | | | | | Bug reported by Michel Sales. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix s_server/s_client handling of the split_send_frag argumentMatt Caswell2016-03-072-4/+10
| | | | | | | Ensure that a value of 0 is correctly handled for the split_send_frag argument. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for new s_server/s_client optionsMatt Caswell2016-03-072-2/+2
| | | | | | Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Ensure s_client and s_server work when read_ahead is setMatt Caswell2016-03-072-3/+3
| | | | | | | | | Previously s_client and s_server relied on using SSL_pending() which does not take into account read_ahead. For read pipelining to work, read_ahead gets set automatically. Therefore s_client and s_server have been converted to use SSL_has_pending() instead. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add an ability to set the SSL read buffer sizeMatt Caswell2016-03-072-3/+24
| | | | | | | | | This capability is required for read pipelining. We will only read in as many records as will fit in the read buffer (and the network can provide in one go). The bigger the buffer the more records we can process in parallel. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add pipeline support to s_server and s_clientMatt Caswell2016-03-072-2/+68
| | | | | | | | | Add the options min_send_frag and max_pipelines to s_server and s_client in order to control pipelining capabilities. This will only have an effect if a pipeline capable cipher is used (such as the one provided by the dasync engine). Reviewed-by: Tim Hudson <tjh@openssl.org>
* ISSUE 43: Add BIO_sock_shutdownRich Salz2016-03-074-13/+13
| | | | | | This replaces SHUTDOWN/SHUTDOWN2 with BIO_closesocket. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a function to detect if we have async or notMatt Caswell2016-03-071-27/+15
| | | | | | | Add the ASYNC_is_capable() function and use it in speed. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make PKCS8_PRIV_KEY_INFO opaque.Dr. Stephen Henson2016-03-072-43/+5
| | | | | | | | | | Make PKCS8_PRIV_KEY_INFO opaque. Several accessor functions already exist for this structure. Two new ones were added to handle attributes. The old handling of broken formats has been removed and the corresponding structures simplified. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add support to ASYNC_WAIT_CTX to speedAndrea Grandi2016-03-071-18/+97
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove unnecessary memset() to 0 and check for NULL before OPENSSL_free()Andrea Grandi2016-03-071-25/+7
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix the error with RSA and the daysnc engine in async mode.Andrea Grandi2016-03-071-152/+211
| | | | | | | | | Move RSA struct in the job local struct. The change is applied also to other crypto operations (e.g. DSA) to make things consistent. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Add support for async jobs in OpenSSL speedAndrea Grandi2016-03-071-454/+1064
| | | | | | | | | | | | | | | | | | | Summary of the changes: * Move the calls to the crypto operations inside wrapper functions. This is required because ASYNC_start_job takes a function as an argument. * Add new function run_benchmark() that manages the jobs for all the operations. In the POSIX case it uses a select() to receive the events from the engine and resume the jobs that are paused, while in the WIN case it uses PeekNamedPipe() * Add new option argument async_jobs to enable and specify the number of async jobs Example: openssl speed -engine dasync -elapsed -async_jobs 32 rsa2048 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* use saner default parameters for scryptDr. Stephen Henson2016-03-051-2/+2
| | | | | | Thanks to Colin Percival for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make formatting consistent in apps/Makefile.inRob Percival2016-03-041-20/+20
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove redundant semi-colons from apps/Makefile.inRob Percival2016-03-041-6/+6
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Extends s_client to allow a basic CT policy to be enabledRob Percival2016-03-046-6/+122
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add KDF support to pkeyutl. Update documentation.Dr. Stephen Henson2016-03-031-18/+46
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix -pkeyopt and fix error check.Dr. Stephen Henson2016-03-011-2/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH764: s_server: trace option fall throughJ Mohan Rao Arisankala2016-02-291-2/+1
| | | | | | | | in s_server cmd: specifying -trace option, falls through and turn-on security_debug Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Refactor the async wait fd logicMatt Caswell2016-02-291-5/+17
| | | | | | | | | | | | | | | | | | | Implementation experience has shown that the original plan for async wait fds was too simplistic. Originally the async logic created a pipe internally and user/engine code could then get access to it via API calls. It is more flexible if the engine is able to create its own fd and provide it to the async code. Another issue is that there can be a lot of churn in the fd value within the context of (say) a single SSL connection leading to continually adding and removing fds from (say) epoll. It is better if we can provide some stability of the fd value across a whole SSL connection. This is problematic because an engine has no concept of an SSL connection. This commit refactors things to introduce an ASYNC_WAIT_CTX which acts as a proxy for an SSL connection down at the engine layer. Reviewed-by: Richard Levitte <levitte@openssl.org>
* add ecdhx25519 option to speedDr. Stephen Henson2016-02-281-5/+11
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* using macro inside the case.J Mohan Rao Arisankala2016-02-271-2/+2
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* fix build with no-srtpJ Mohan Rao Arisankala2016-02-271-1/+3
| | | | | | | | | - srtp_profiles variable is defined when building with SRTP, keeping the variable usage also under ifndef OPENSSL_NO_SRTP - alpn help option was kept under ifndef OPENSSL_NO_SRTP Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT2275: use BIO_sock_nbio()Rich Salz2016-02-272-35/+8
| | | | | | Now that BIO_sock_nbio is available, use it in the apps. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Drop support for printing SSLv2 ciphers names.Kurt Roeckx2016-02-271-2/+3
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2083
* GH715: ENGINE_finish can take NULLRich Salz2016-02-252-6/+3
| | | | | | | Simplifies calling code. Also fixed up any !ptr tests that were nearby, turning them into NULL tests. Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH463: Fix OPENSSL_NO_OCSP buildRich Salz2016-02-252-2/+7
| | | | | | | Fixes github issue 463. Building the app without OPENSSL_NO_SOCK isn't supported, so only do OPENSSL_NO_OCSP. Reviewed-by: Andy Polyakov <appro@openssl.org>
* CVE-2016-0798: avoid memory leak in SRPEmilia Kasper2016-02-251-16/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not configure SRP, or configure SRP but do not configure a seed are not vulnerable. In Apache, the seed directive is known as SSLSRPUnknownUserSeed. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user. However, note that OpenSSL makes no strong guarantees about the indistinguishability of valid and invalid logins. In particular, computations are currently not carried out in constant time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH480: Don't break statements with CPP stuff.Flavio Medeiros2016-02-242-10/+11
| | | | | | | This is also RT 4137 Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Andy Polyakov <appro@openssl.org>
* Fix typo, reformat comment.Rich Salz2016-02-241-6/+5
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove unused parameters from internal functionsRich Salz2016-02-2218-145/+100
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* MemorySanitizer: address false positiveEmilia Kasper2016-02-221-0/+16
| | | | | | | | Explicitly unpoison the result of FD_ZERO Tests now pass, using -fsanitize=memory Reviewed-by: Rich Salz <rsalz@openssl.org>
* argv was set but unusedKurt Roeckx2016-02-2023-23/+55
| | | | | | | | Also gives an error message when you gave it a parameter it didn't expect. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2009
* Rethink the uplink / applink storyRichard Levitte2016-02-192-2/+4
| | | | | | | | | | | | | | | | Adding uplink and applink to some builds was done by "magic", the configuration for "mingw" only had a macro definition, the Configure would react to its presence by adding the uplink source files to cpuid_asm_src, and crypto/build.info inherited dance to get it compiled, and Makefile.shared made sure applink.o would be appropriately linked in. That was a lot under the hood. To replace this, we create a few template configurations in Configurations/00-base-templates.conf, inherit one of them in the "mingw" configuration, the rest is just about refering to the $target{apps_aux_src} / $target{apps_obj} in the right places. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove all special make depend flags, as well as OPENSSL_DOING_MAKEDEPENDRichard Levitte2016-02-181-1/+1
| | | | | | | | | | All those flags existed because we had all the dependencies versioned in the repository, and wanted to have it be consistent, no matter what the local configuration was. Now that the dependencies are gone from the versioned Makefile.ins, it makes much more sense to use the exact same flags as when compiling the object files. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove outdated DEBUG flags.Rich Salz2016-02-182-84/+9
| | | | | | | | | | | | | | | | | Add -DBIO_DEBUG to --strict-warnings. Remove comments about outdated debugging ifdef guards. Remove md_rand ifdef guarding an assert; it doesn't seem used. Remove the conf guards in conf_api since we use OPENSSL_assert, not assert. For pkcs12 stuff put OPENSSL_ in front of the macro name. Merge TLS_DEBUG into SSL_DEBUG. Various things just turned on/off asserts, mainly for checking non-NULL arguments, which is now removed: camellia, bn_ctx, crypto/modes. Remove some old debug code, that basically just printed things to stderr: DEBUG_PRINT_UNKNOWN_CIPHERSUITES, DEBUG_ZLIB, OPENSSL_RI_DEBUG, RL_DEBUG, RSA_DEBUG, SCRYPT_DEBUG. Remove OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL. Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 09:58:57 +0000