aboutsummaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* Remove TLS heartbeat, disable DTLS heartbeatRich Salz2016-02-113-15/+31
| | | | | | | | | To enable heartbeats for DTLS, configure with enable-heartbeats. Heartbeats for TLS have been completely removed. This addresses RT 3647 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move to REF_DEBUG, for consistency.Rich Salz2016-02-111-0/+1
| | | | | | | Add utility macros REF_ASSERT_NOT and REF_PRINT_COUNT This is also RT 4181 Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH620: second diff from rt-2275, adds error codeRich Salz2016-02-111-0/+1
| | | | | | | clean up and apply patches from RT-2275 Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Hide OPENSSL_INIT_SETTINGS.Rich Salz2016-02-114-22/+13
| | | | | Make OPENSSL_INIT_SETTINGS an opaque structure. Reviewed-by: Richard Levitte <levitte@openssl.org>
* After renaming init, update errors.Rich Salz2016-02-102-2/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Make it possible to get ENGINESDIR info from OpenSSL_versionsRichard Levitte2016-02-101-0/+1
| | | | | | | | Have apps/openssl display the result along with OPENSSLDIR As part of this, add ENGINESDIR in util/mk1mf.pl Reviewed-by: Rich Salz <rsalz@openssl.org>
* Attempt to log an error if init failedMatt Caswell2016-02-103-1/+3
| | | | | | | | | If init failed we'd like to set an error code to indicate that. But if init failed then when the error system tries to load its strings its going to fail again. We could get into an infinite loop. Therefore we just set a single error the first time around. After that no error is set. Reviewed-by: Rich Salz <rsalz@openssl.org>
* The new init functions can now fail so shouldn't be voidMatt Caswell2016-02-103-2/+3
| | | | | | | The new init functions can fail if the library has already been stopped. We should be able to indicate failure with a 0 return value. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate the -issuer_checks debugging optionViktor Dukhovni2016-02-101-9/+5
| | | | | | | | | | | | This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
* The guard macro to be defined didn't match the guard macro checkedRichard Levitte2016-02-101-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Rename INIT funtions, deprecate old ones.Rich Salz2016-02-107-52/+118
| | | | | | Man, there were a lot of renamings :) Reviewed-by: Richard Levitte <levitte@openssl.org>
* clean away old VMS cruftRichard Levitte2016-02-101-366/+1
| | | | | | | | | | | | The old building scripts get removed, they are hopelessly gone in bit rot by now. Also remove the old symbol hacks. They were needed needed to shorten some names to 31 characters, and to resolve other symbol clashes. Because we now compile with /NAMES=(AS_IS,SHORTENED), this is no longer required. Reviewed-by: Rich Salz <rsalz@openssl.org>
* unified build scheme: add a "unified" template for VMS descrip.mmsRichard Levitte2016-02-102-0/+18
| | | | | | | | | | | | | | | | | | | As part of this, change util/mkdef.pl to stop adding libraries to depend on in its output. mkdef.pl should ONLY output a symbol vector. Because symbol names can't be longer than 31 characters, we use the compiler to shorten those that are longer down to 23 characters plus an 8 character CRC. To make sure users of our header files will pick up on that automatically, add the DEC C supported extra headers files __decc_include_prologue.h and __decc_include_epilogue.h. Furthermore, we add a config.com, so VMS people can configure just as comfortably as any Unix folks, thusly: @config Reviewed-by: Rich Salz <rsalz@openssl.org>
* Configure et al: move the installation directory logic to MakefilesRichard Levitte2016-02-101-7/+0
| | | | | | | | | | | | | | | | | | | | The logic to figure out the combinations of --prefix and --openssldir has stayed in Configure so far, with Unix paths as defaults. However, since we're making Configure increasingly platform agnostic, these defaults need to change and adapt to the platform, along with the logic to combine them. The easiest to provide for this is to move the logic and the defaults away from Configure and into the build files. This also means that the definition of the macros ENGINESDIR and OPENSSLDIR move away from include/openssl/opensslconf.h and into the build files. Makefile.in is adapted accordingly. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove store.Rich Salz2016-02-103-675/+0
| | | | | | | Rebased and merged by me, with Ben's approval. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Ben Laurie <ben@openssl.org>
* Use NON_EMPTY_TRANSLATION_UNIT, consistently.Rich Salz2016-02-091-0/+6
| | | | | | This also closes RT 4123 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Updates for auto init/deinit review commentsMatt Caswell2016-02-091-1/+1
| | | | | | Fixes for the auto-init/deinit code based on review comments Reviewed-by: Richard Levitte <levitte@openssl.org>
* Provide a thread stop APIMatt Caswell2016-02-091-0/+1
| | | | | | Add the OPENSSL_INIT_thread_stop() function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Auto init/de-init libsslMatt Caswell2016-02-091-2/+5
| | | | | | Building on the pervious commit to auto initialise and de-initialise libssl Reviewed-by: Richard Levitte <levitte@openssl.org>
* Auto init/deinit libcryptoMatt Caswell2016-02-097-31/+39
| | | | | | | This builds on the previous commit to auto initialise/deinitialise libcrypto. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Provide framework for auto initialise/deinitialise of the libraryMatt Caswell2016-02-092-0/+64
| | | | | | | | | | | | This commit provides the basis and core code for an auto initialisation and deinitialisation framework for libcrypto and libssl. The intention is to remove the need (in many circumstances) to call explicit initialise and deinitialise functions. Explicit initialisation will still be an option, and if non-default initialisation is needed then it will be required. Similarly for de-initialisation (although this will be a lot easier since it will bring all de-initialisation into a single function). Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove ancient compatibility defines.Dr. Stephen Henson2016-02-081-14/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Only use compatibility macros for < 1.1 API.Dr. Stephen Henson2016-02-081-1/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* use new function namesDr. Stephen Henson2016-02-081-10/+14
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Reorganise functions.Dr. Stephen Henson2016-02-081-9/+11
| | | | | | | | Move all PKCS12_SAFEBAG functions into new file p12_sbag.c. Move MAC functions into p12_mutl.c Reviewed-by: Rich Salz <rsalz@openssl.org>
* pkcs12.h header reorganisation.Dr. Stephen Henson2016-02-081-5/+7
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Rename PKCS12 functionDr. Stephen Henson2016-02-081-7/+16
| | | | | | | Rename ancient PKCS12 functions to use more logical names. Include defines from old to new name. Reviewed-by: Rich Salz <rsalz@openssl.org>
* pkcs12 accessorsDr. Stephen Henson2016-02-081-0/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* New PKCS12 accessors, change macros to functions.Dr. Stephen Henson2016-02-081-11/+11
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make PKCS12 structures opaqueDr. Stephen Henson2016-02-081-33/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate undocumented SSL_cache_hit().Dr. Stephen Henson2016-02-081-4/+4
| | | | | | | Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Handle SSL_shutdown while in init more appropriately #2Matt Caswell2016-02-081-1/+0
| | | | | | | | | | | | | | | | | | | Previous commit 7bb196a71 attempted to "fix" a problem with the way SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had SSL_shutdown() return immediately having taken no action if called mid- handshake with a return value of 1 (meaning everything was shutdown successfully). In fact the shutdown has not been successful. Commit 7bb196a71 changed that to send a close_notify anyway and then return. This seems to be causing some problems for some applications so perhaps a better (much simpler) approach is revert to the previous behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown was not successful). This also fixes a bug where SSL_shutdown always returns 0 when shutdown *very* early in the handshake (i.e. we are still using SSLv23_method). Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add SSL_get0_verified_chain() to return verified chain of peerDr. Stephen Henson2016-02-061-0/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add a BIO_ADDR_clear functionMatt Caswell2016-02-051-0/+1
| | | | | | | Adds a new function BIO_ADDR_clear to reset a BIO_ADDR back to an unitialised state, and to set the family to AF_UNSPEC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-054-5/+5
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Make DTLSv1_listen a first class function and change its typeMatt Caswell2016-02-051-4/+3
| | | | | | | | | The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Long overdue cleanup of X509 policy tree verificationViktor Dukhovni2016-02-051-8/+20
| | | | | | | | | Replace all magic numbers with #defined constants except in boolean functions that return 0 for failure and 1 for success. Avoid a couple memory leaks in error recovery code paths. Code style improvements. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add EC_KEY_priv2buf()Dr. Stephen Henson2016-02-051-0/+7
| | | | | | | Add new function EC_KEY_priv2buf() to allocated and encode private key octet in one call. Update and simplify ASN.1 and print routines. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* update EC ASN1 and print routinesDr. Stephen Henson2016-02-051-0/+2
| | | | | | | Update EC ASN.1 and print routines to use EC_KEY_oct2priv and EC_KEY_priv2oct. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add EC_KEY_oct2priv and EC_KEY_priv2octDr. Stephen Henson2016-02-051-0/+20
| | | | | | | | New functions EC_KEY_oct2priv and EC_KEY_priv2oct. These are private key equivalents of EC_POINT_oct2point and EC_POINT_point2oct which convert between the private key octet format and EC_KEY. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add ASN1_buf_print to print a buffer in ASN1_bn_print format.Dr. Stephen Henson2016-02-051-0/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add new DTLS-SRTP protection profiles from RFC 7714Dmitry Sobinov2016-02-041-0/+4
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Use WSAGetLastError() on windowsKurt Roeckx2016-02-041-0/+1
| | | | | | | | Windows doesn't have h_error or hstrerror() Reviewed-by: Richard Levitte <levitte@openssl.org> MR: #1848
* update OID tablesDr. Stephen Henson2016-02-041-0/+16
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* RT2752: Add some EKU OID'sRich Salz2016-02-031-0/+54
| | | | | | And some others found in the Internet. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Tweak opensslconf.h.in for styleRich Salz2016-02-032-75/+46
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* make updateRichard Levitte2016-02-031-0/+5
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Refactoring BIO: adapt BIO_s_connect and BIO_s_acceptRichard Levitte2016-02-031-29/+33
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* make updateRichard Levitte2016-02-031-0/+1
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-01 10:20:57 +0000