aboutsummaryrefslogtreecommitdiffstats
path: root/include/openssl
Commit message (Collapse)AuthorAgeFilesLines
* Add parentheses on public macros where appropriate.Bernd Edlinger2017-04-2711-147/+168
| | | | | | | Fixes #3063. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3100)
* Add support for SSL_SESSION_is_resumable()Matt Caswell2017-04-261-0/+1
| | | | | | | Provide a way to test whether the SSL_SESSION object can be used to resume a sesion or not. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* Add support for custom signature parametersDr. Stephen Henson2017-04-252-0/+17
| | | | | | | | | | | | | | | | | | Many signature types define the digest and public key type by a single OID such as ecdsa_with_sha256. Some types (RSA-PSS for example) use a single OID to indicate the signature scheme and additional parameters are encoded in the AlgorithmIdentifier. Add an X509_SIG_INFO structure to contain details about the signature type: specifically the digest algorithm, public key algorithm, security bits and various flags. This supports both existing algorithms and more complex types. Add accessors for the structure and a special case that retrieves signature information from a certificate. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Switch command-line utils to new nameopt API.Dmitry Belyavskiy2017-04-251-0/+1
| | | | | | | | | | | | | | | | | The CA names should be printed according to user's decision print_name instead of set of BIO_printf dump_cert_text instead of set of BIO_printf Testing cyrillic output of X509_CRL_print_ex Write and use X509_CRL_print_ex Reduce usage of X509_NAME_online Using X509_REQ_print_ex instead of X509_REQ_print Fix nameopt processing. Make dump_cert_text nameopt-friendly Move nameopt getter/setter to apps/apps.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3262)
* Document BIO_lookup_ex()Matt Caswell2017-04-251-2/+2
| | | | | | We also change the enum type to an int. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Don't attempt to send fragments > max_send_fragment in DTLSMatt Caswell2017-04-251-0/+1
| | | | | | | | | We were allocating the write buffer based on the size of max_send_fragment, but ignoring it when writing data. We should fragment handshake messages if they exceed max_send_fragment and reject application data writes that are too large. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Add better error logging if SCTP AUTH chunks are not enabledMatt Caswell2017-04-251-0/+1
| | | | | | | In order to use SCTP over DTLS we need ACTP AUTH chunks to be enabled in the kernel. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Add a BIO_lookup_ex() functionMatt Caswell2017-04-251-0/+4
| | | | | | | | | | | | The existing BIO_lookup() wraps a call to getaddrinfo and provides an abstracted capability to lookup addresses based on socket type and family. However it provides no ability to lookup based on protocol. Normally, when dealing with TCP/UDP this is not required. However getaddrinfo (at least on linux) never returns SCTP addresses unless you specifically ask for them in the protocol field. Therefore BIO_lookup_ex() is added which provides the protocol field. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Fix typo in OPENSSL_LH_new compat APIRich Salz2017-04-241-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3292)
* Add CRYPTO_mem_leaks_cbRichard Levitte2017-04-241-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3243)
* Ignore dups in X509_STORE_add_*Rich Salz2017-04-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | X509_STORE_add_cert and X509_STORE_add_crl are changed to return success if the object to be added was already found in the store, rather than returning an error. Raise errors if empty or malformed files are read when loading certificates and CRLs. Remove NULL checks and allow a segv to occur. Add error handing for all calls to X509_STORE_add_c{ert|tl} Refactor these two routines into one. Bring the unit test for duplicate certificates up to date using the test framework. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2830)
* ASN.1: extend the possibilities to embed data instead of pointersRichard Levitte2017-04-131-0/+5
| | | | | | | | | | Also, when "allocating" or "deallocating" an embedded item, never call prim_new() or prim_free(). Call prim_clear() instead. Fixes #3191 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3199)
* OCSP Updates: error codes and multiple certificatesTodd Short2017-04-121-0/+4
| | | | | | | | | | | | | | RT3877: Add X509 OCSP error codes and messages Add additional OCSP error codes for X509 verify usage RT3867: Support Multiple CA certs in ocsp app Add the ability to read multiple CA certs from a single file in the ocsp app. Update some missing X509 errors in documentation. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/941)
* Discourage the use of LONG and ZLONG, and deprecate it in the futureRichard Levitte2017-04-101-0/+8
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Publish our INT32, UINT32, INT64, UINT64 ASN.1 types and Z variantsRichard Levitte2017-04-101-0/+8
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Make default_method mostly compile-time (cont'd)Rich Salz2017-04-071-5/+5
| | | | | | | Forgot to include this commit as requested by review. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2244)
* Make default_method mostly compile-timeRich Salz2017-04-071-7/+6
| | | | | | | | Document thread-safety issues Have RSA_null return NULL (always fails) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2244)
* Prefix custom extension API callback types with SSL_Matt Caswell2017-04-071-18/+21
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Implement a new custom extensions APIMatt Caswell2017-04-071-9/+36
| | | | | | | | The old custom extensions API was not TLSv1.3 aware. Extensions are used extensively in TLSv1.3 and they can appear in many different types of messages. Therefore we need a new API to be able to cope with that. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* Move the extensions context codes into the public APIMatt Caswell2017-04-071-0/+23
| | | | | | | | This move prepares for the later addition of the new custom extensions API. The context codes have an additional "SSL_" added to their name to ensure we don't have name clashes with other applications. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* e_os2.h: Refine OSSL_SSIZE definition under UEFI environmentQin Long2017-04-061-3/+3
| | | | | | | | | | | | | | | Under UEFI build environment, we may encounter the OSSL_SSIZE macro re-definition error in e_os2.h if any module call OpenSSL API directly by including "openssl/xxxx.h" (caused by the predefined _WIN32/_WIN64 macro, which should have been un-defined under OPENSSL_SYS_UEFI). Though it's not one recommended usage, this patch could still eliminate the possible build issue by refining the OSSL_SSIZE definition under OPENSSL_SYS_UEFI. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3121)
* make updateRichard Levitte2017-04-041-0/+3
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* Constify SSL_dup_CA_list()Dr. Stephen Henson2017-04-031-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3015)
* New certificate_authorities functionsDr. Stephen Henson2017-04-031-0/+8
| | | | | | | | | Add functions to add/retrieve the certificate_authorities. The older client_CA functions mainly just call the new versions now. Rename fields sice new extension can be generated by client and server. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3015)
* Add missing macros for DHxparamsMatt Caswell2017-04-031-6/+23
| | | | | | | DHparams has d2i_DHparams_fp, d2i_DHxparams_bio etc, but the equivalent macros for DHxparams were omitted. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3111)
* Fix a typo in the SSL_get_max_early_data() declarationsKazuki Yamaguchi2017-04-031-1/+1
| | | | | | | | | SSL_get_max_early_data() recently added by 3fc8d856105e ("Construct the ticket_early_data_info extension", 2017-02-17) is supposed to take an SSL, but it doesn't. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3113)
* e_os.h: drop now-redundant PRIu64 [and fix OSSLzu].Andy Polyakov2017-03-301-1/+0
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3083)
* Add z modifier parsing to the BIO_printf et all format stringRichard Levitte2017-03-291-4/+10
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3064)
* More typo fixesFdaSilvaYY2017-03-294-5/+5
| | | | | | | | Fix some comments too [skip ci] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3069)
* Move PRIu64, OSSLzu to e_os.hRich Salz2017-03-281-23/+0
| | | | | | Those macros are private, not public. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3044)
* Remove redundant decl of 509_STORE_set_flagsHannes Magnusson2017-03-281-1/+0
| | | | | | | | | | | a47bc283 accidentally adds another define for X509_STORE_set_flags It is already defined 5lines prior CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3047)
* Fix function documentationIan Spence2017-03-241-7/+2
| | | | | | | CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2972)
* Fix the error handling in CRYPTO_dup_ex_data.Bernd Edlinger2017-03-201-1/+1
| | | | | | | | Fix a strict aliasing issue in ui_dup_method_data. Add test coverage for CRYPTO_dup_ex_data, use OPENSSL_assert. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2988)
* Make the CRYPTO_memcmp() prototype match memcmp()Kurt Roeckx2017-03-191-3/+1
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> GH: #2633
* Implement certificate_authorities extensionDr. Stephen Henson2017-03-172-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2918)
* Move parsing and construction of CA names to separate functionsDr. Stephen Henson2017-03-171-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2918)
* HelloRetryRequest updates for draft-19Matt Caswell2017-03-162-2/+6
| | | | | | | | Draft-19 changes the HRR transcript hash so that the initial ClientHello is replaced in the transcript with a special synthetic message_hash message that just contains a hash of ClientHello1 as its message body. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* Merge early_data_info extension into early_dataMatt Caswell2017-03-162-1/+1
| | | | | | As per draft-19 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* Update end of early data processing for draft-19Matt Caswell2017-03-162-2/+6
| | | | | | | The end of early data is now indicated by a new handshake message rather than an alert. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* Update the TLSv1.3 version indicator for draft-19Matt Caswell2017-03-161-3/+3
| | | | | | | This change will mean we will lose interoperability with draft-18 implementations. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* Remove some unused PEM structuresBenjamin Kaduk2017-03-161-50/+0
| | | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2797)
* Add EC_KEY_get0_engine()Richard Levitte2017-03-151-0/+6
| | | | | | | Just as for DH, DSA and RSA, this gives the engine associated with the key. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2960)
* Fix out-of-memory condition in confMatt Caswell2017-03-121-0/+1
| | | | | | | | | | | | conf has the ability to expand variables in config files. Repeatedly doing this can lead to an exponential increase in the amount of memory required. This places a limit on the length of a value that can result from an expansion. Credit to OSS-Fuzz for finding this problem. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2894)
* Use the new TLSv1.3 certificate_required alert where appropriateMatt Caswell2017-03-102-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2898)
* Check TLSv1.3 ServerHello, Finished and KeyUpdates are on record boundaryMatt Caswell2017-03-071-0/+1
| | | | | | | | | In TLSv1.3 the above messages signal a key change. The spec requires that the end of these messages must align with a record boundary. We can detect this by checking for decrypted but as yet unread record data sitting in OpenSSL buffers at the point where we process the messages. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2875)
* Tweak the TLSv1.3 record overflow limitsMatt Caswell2017-03-061-4/+7
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2861)
* Add basic TLSv1.3 cookie supportMatt Caswell2017-03-042-0/+3
| | | | | | | We do not allow the generation of TLSv1.3 cookies. But if we receive one in an HRR we will echo it back in the ClientHello. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2839)
* Set specific error is we have no valid signature algorithms setDr. Stephen Henson2017-03-031-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2840)
* Rename SSL_write_early() to SSL_write_early_data()Matt Caswell2017-03-021-3/+3
| | | | | | | This is for consistency with the rest of the API where all the functions are called *early_data*. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Rename SSL_read_early() to SSL_read_early_data()Matt Caswell2017-03-021-5/+6
| | | | | | | This is for consistency with the rest of the API where all the functions are called *early_data*. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-27 01:41:46 +0000