aboutsummaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* Make it possible to check for explicit auxiliary trustViktor Dukhovni2016-01-291-2/+3
| | | | | | | | | | | | | | | By default X509_check_trust() trusts self-signed certificates from the trust store that have no explicit local trust/reject oids encapsulated as a "TRUSTED CERTIFICATE" object. (See the -addtrust and -trustout options of x509(1)). This commit adds a flag that makes it possible to distinguish between that implicit trust, and explicit auxiliary settings. With flags |= X509_TRUST_NO_SS_COMPAT, a certificate is only trusted via explicit trust settings. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Correct value of DH_CHECK_PUBKEY_INVALIDMatt Caswell2016-01-291-1/+1
| | | | | | | | | | A new return value for DH_check_pub_key was recently added: DH_CHECK_PUBKEY_INVALID. As this is a flag which can be ORed with other return values it should have been set to the value 4 not 3. RT#4278 Reviewed-by: Andy Polyakov <appro@openssl.org>
* Correct number of arguments in BIO_get_conn_int_port macroRichard Levitte2016-01-281-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Prevent small subgroup attacks on DH/DHEMatt Caswell2016-01-281-0/+1
| | | | | | | | | | | | | | | | | | | Historically OpenSSL only ever generated DH parameters based on "safe" primes. More recently (in version 1.0.2) support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be "safe". Where an application is using DH configured with parameters based on primes that are not "safe" then an attacker could use this fact to find a peer's private DH exponent. This attack requires that the attacker complete multiple handshakes in which the peer uses the same DH exponent. A simple mitigation is to ensure that y^q (mod p) == 1 CVE-2016-0701 Issue reported by Antonio Sanso. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix typo in md2.hRich Salz2016-01-281-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add CRYPTO_secure_zallocRich Salz2016-01-271-0/+5
| | | | | | Also turn B<foo> into foo() in the pod page. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Remove outdated legacy crypto optionsRich Salz2016-01-275-11/+11
| | | | | | | | | | | | | | | | | | | | | | Many options for supporting optimizations for legacy crypto on legacy platforms have been removed. This simplifies the source code and does not really penalize anyone. DES_PTR (always on) DES_RISC1, DES_RISC2 (always off) DES_INT (always 'unsigned int') DES_UNROLL (always on) BF_PTR (always on) BF_PTR2 (removed) MD2_CHAR, MD2_LONG (always 'unsigned char') IDEA_SHORT, IDEA_LONG (always 'unsigned int') RC2_SHORT, RC2_LONG (always 'unsigned int') RC4_LONG (only int and char (for assembler) are supported) RC4_CHUNK (always long), RC_CHUNK_LL (removed) RC4_INDEX (always on) And also make D_ENCRYPT macro more clear (@appro) This is done in consultation with Andy. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Complete the removal of /* foo.c */ commentsRichard Levitte2016-01-271-1/+0
| | | | | | | Some files that are automatically generated still had those comments added by the generating scripts. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-2665-65/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add SSL_up_ref() and SSL_CTX_up_ref()Matt Caswell2016-01-261-0/+2
| | | | | | | | The SSL and SSL_CTX structures are reference counted. However since libssl was made opaque there is no way for users of the library to manipulate the reference counts. This adds functions to enable that. Reviewed-by: Stephen Henson <steve@openssl.org>
* Generate warning textRichard Levitte2016-01-251-1/+1
| | | | | | | | | | | | | | Now that we're using templates, we should warn people not to edit the resulting file. We do it through util/dofile.pl, which is enhanced with an option to tell what file it was called from. We also change the calls so the template files are on the command line instead of being redirected through standard input. That way, we can display something like this (example taken from include/openssl/opensslconf.h): /* WARNING: do not edit! */ /* Generated by Configure from include/openssl/opensslconf.h.in */ Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move & split opensslconf.h.inRich Salz2016-01-251-0/+173
| | | | | | | | Move opensslconf.h.in to include/openssl. Split off DES,BN,RC4 stuff into separate header file templates in crypto/include/internal/*_conf.h.in Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move pqueue into sslRich Salz2016-01-241-99/+0
| | | | | | | | | | | This is an internal facility, never documented, not for public consumption. Move it into ssl (where it's only used for DTLS). I also made the typedef's for pqueue and pitem follow our style: they name structures, not pointers. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Updated OSSL_DYNAMIC_VERSION/OSSL_DYNAMIC_OLDESTMichał Trojnara2016-01-221-2/+2
| | | | | | | Change to reflect changes in dynamic_fns Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Handle SSL_shutdown while in init more appropriatelyMatt Caswell2016-01-201-0/+2
| | | | | | | | | | | | | | | Calling SSL_shutdown while in init previously gave a "1" response, meaning everything was successfully closed down (even though it wasn't). Better is to send our close_notify, but fail when trying to receive one. The problem with doing a shutdown while in the middle of a handshake is that once our close_notify is sent we shouldn't really do anything else (including process handshake/CCS messages) until we've received a close_notify back from the peer. However the peer might send a CCS before acting on our close_notify - so we won't be able to read it because we're not acting on CCS messages! Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* make EVP_PKEY opaqueDr. Stephen Henson2016-01-201-30/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove the GOST engineMatt Caswell2016-01-191-3/+0
| | | | | | | | | | The GOST engine is now out of date and is removed by this commit. An up to date GOST engine is now being maintained in an external repository. See: https://wiki.openssl.org/index.php/Binaries Reviewed-by: Richard Levitte <levitte@openssl.org>
* API compat for SSLeay_add_ssl_algorithmsViktor Dukhovni2016-01-191-0/+3
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add TLS PRF method.Dr. Stephen Henson2016-01-193-0/+86
| | | | | | Add EVP_PKEY algorithm for TLS1 PRF. Reviewed-by: Matt Caswell <matt@openssl.org>
* Use POSIX functions on Cygwin, not Win32 functionCorinna Vinschen2016-01-181-1/+1
| | | | | | | Signed-off-by: Corinna Vinschen <vinschen@redhat.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix function declarations.Rich Salz2016-01-172-4/+4
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add some accessors.Rich Salz2016-01-172-0/+7
| | | | | | | | | | | | | | | | | Author: Remi Gacogne <rgacogne-github@coredump.fr> GH334: Add an OCSP_SINGLERESP_get0_id() accessor to the OCSP_CERTID of a OCSP_SINGLERESP. It is possible to do it the other way around using OCSP_resp_find(), but this is more efficient when you have a tree indexed by OCSP_CERTID, like haproxy does. (This is also RT4251) Author: Marek Klein <kleinmrk@gmail.com> GH556: OCSP_resp_get_produced_at() accessor to the producedAt of a OCSP_BASICRESP GH555: TS_STATUS_INFO_get_status(), TS_STATUS_INFO_get_text() and TS_STATUS_INFO_get_failure_info() accessors for a TS_STATUS_INFO Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* fix no-engine buildDr. Stephen Henson2016-01-161-0/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a no-egd option to disable EGD-related codeBenjamin Kaduk2016-01-141-0/+2
| | | | | | | | The entropy-gathering daemon is used only on a small number of machines. Provide a configure knob so that EGD support can be disabled by default but re-enabled on those systems that do need it. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Make SSL_set_debug deprecated in 1.1Rich Salz2016-01-141-0/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT4232: Extra space in help message.Rich Salz2016-01-141-1/+0
| | | | | | | | | It turns out that -pause calls the undocumented function SSL_set_debug. That just sets flag inside the SSL structure. That flag, despite the command is never used. So remove the flag, the field, and the function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Prepare for 1.1.0-pre3-devRichard Levitte2016-01-141-3/+3
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Prepare for 1.1.0-pre2 releaseOpenSSL_1_1_0-pre2Richard Levitte2016-01-141-2/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* For stro[ui]max require both C99 and UINTMAX_MAX/INTMAX_MAXViktor Dukhovni2016-01-131-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove spurious ;Richard Levitte2016-01-131-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* VMS C doesn't provide intmax_t/uinmax_t, use our ownRichard Levitte2016-01-131-1/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add CRYPTO_EX_DATA; remove EC_EXTRA_DATARich Salz2016-01-132-28/+18
| | | | | | | | | | | | Add CRYPTO_EX_DATA add EndC_KEY_[gs]et_method, From Roumen Petrov. Had to add various exdata calls to init/copy/free the exdata. Had to remove const from some EC functions because exdata isn't const-correct. :( Also remove EC_EXTRA_DATA and use a union to hold the possible pre-computed values and an enum to tell which value is in the union. (Rich Salz) Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Fix DES_LONG breakageViktor Dukhovni2016-01-132-1/+3
| | | | | | | | | | | | | | | For some strange reason opensslconf.h was only defining DES_LONG when included via des.h, but that's exceedingly fragile (as a result of include guards the include via des.h might not actually process the content again). Ripped out the nesting constraint, now always define OSSL_DES_LONG if not already defined. Note, this could just be DES_LONG, but trying to avoid exposing DES_LONG in places where it has never been seen before, so it is up to des.h to actually define DES_LONG as OSSL_DES_LONG. Reviewed-by: Rich Salz <rsalz@openssl.org>
* For stroimax need C99 inttypes.hViktor Dukhovni2016-01-132-17/+9
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix missing casts for c++Mathias Berchtold2016-01-131-3/+3
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Maximize time_t when intmax_t is availableViktor Dukhovni2016-01-121-0/+16
| | | | | | | Well, I'm not actually changing time_t, just changing how time_t valued opt values are converted from string to time_t. Reviewed-by: Rich Salz <rsalz@openssl.org>
* STACK_OF(SSL_COMP) is a public typeViktor Dukhovni2016-01-121-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* fix jpaketest and correct commentDr. Stephen Henson2016-01-121-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove unused internal macrosRichard Levitte2016-01-121-19/+0
| | | | | | | The M_EVP_* macros related to EVP_CIPHER / EVP_CIPHER_CTX are not public, and are unused. Reviewed-by: Rich Salz <rsalz@openssl.org>
* make updateRichard Levitte2016-01-121-3/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add back deprecated functions in macro formRichard Levitte2016-01-121-0/+7
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* EVP_CIPHER_CTX_new_cipher_data was a temporary measure, not needed any moreRichard Levitte2016-01-121-1/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make EVP_CIPHER opaque and add creator/destructor/accessor/writer functionsRichard Levitte2016-01-121-28/+47
| | | | | | | | We follow the method used for EVP_MD. Also, move all the internal EVP_CIPHER building macros from evp_locl.h to evp_int.h. This will benefit our builtin EVP_CIPHERs. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove EVP_CIPHER_CTX_flags, it's only confusingRichard Levitte2016-01-121-2/+1
| | | | | | | | EVP_CIPHER_CTX_flags was returning the flags of its associated EVP_CIPHER. However, EVP_CIPHER_CTX has flags of its own, so this function is quite confusing and therefore error prone. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add accessors and writers for EVP_CIPHER_CTXRichard Levitte2016-01-121-0/+9
| | | | | | | | | | | | | | | | | | | | | New functions: - EVP_CIPHER_CTX_encrypting() - EVP_CIPHER_CTX_iv() - EVP_CIPHER_CTX_iv_noconst() - EVP_CIPHER_CTX_original_iv() - EVP_CIPHER_CTX_buf_noconst() - EVP_CIPHER_CTX_num() - EVP_CIPHER_CTX_set_num() - EVP_CIPHER_CTX_cipher_data() - EVP_CIPHER_CTX_new_cipher_data() Note that the accessors / writers for iv, buf and num may go away, as those rather belong in the implementation's own structure (cipher_data) when the implementation would affect them (that would be the case when they are flagged EVP_CIPH_CUSTOM_IV or EVP_CIPH_FLAG_CUSTOM_CIPHER). Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make EVP_CIPHER_CTX opaque and renew the creator / destructor functionsRichard Levitte2016-01-121-21/+3
| | | | | | | | | | | Following the method used for EVP_MD_CTX and HMAC_CTX, EVP_CIPHER_CTX_init and EVP_CIPHER_CTX_cleanup are joined together into one function, EVP_CIPHER_CTX_reset, with EVP_CIPHER_CTX_init kept as an alias. EVP_CIPHER_CTX_cleanup fills no purpose of its own any more and is therefore removed. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use ossl_inline and DEFINE_LHASH_OFDr. Stephen Henson2016-01-113-19/+19
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove mkstack.pl: it is no longer needed.Dr. Stephen Henson2016-01-111-23/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add lh_doall_arg inliningDr. Stephen Henson2016-01-112-24/+16
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add lh_doall inliningDr. Stephen Henson2016-01-112-22/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-12 09:41:34 +0000