aboutsummaryrefslogtreecommitdiffstats
path: root/ssl/ssl_ciph.c
Commit message (Collapse)AuthorAgeFilesLines
...
* Patch containing TLS implementation for GOST 2012Dmitry Belyavsky2015-11-231-11/+54
| | | | | | | | This patch contains the necessary changes to provide GOST 2012 ciphersuites in TLS. It requires the use of an external GOST 2012 engine. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Ensure all EVP calls have their returns checked where appropriateMatt Caswell2015-11-201-4/+7
| | | | | | | | There are lots of calls to EVP functions from within libssl There were various places where we should probably check the return value but don't. This adds these checks. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add "TLSv1.0" cipher alias.Dr. Stephen Henson2015-11-141-0/+1
| | | | | | | | This adds a TLSv1.0 cipher alias for ciphersuites requiring at least TLSv1.0: currently only PSK ciphersuites using SHA256 or SHA384 MAC (SSLv3 only supports SHA1 and MD5 MAC). Reviewed-by: Matt Caswell <matt@openssl.org>
* Don't alow TLS v1.0 ciphersuites for SSLv3Dr. Stephen Henson2015-11-141-0/+2
| | | | | | | | | This disables some ciphersuites which aren't supported in SSL v3: specifically PSK ciphersuites which use SHA256 or SHA384 for the MAC. Thanks to the Open Crypto Audit Project for identifying this issue. Reviewed-by: Matt Caswell <matt@openssl.org>
* Use SSL_TLSV1 only if at least TLS v1.0 is needed.Dr. Stephen Henson2015-11-141-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Standardise our style for checking malloc failuresMatt Caswell2015-11-091-1/+1
| | | | | | | | if we have a malloc |x = OPENSSL_malloc(...)| sometimes we check |x| for NULL and sometimes we treat it as a boolean |if(!x) ...|. Standardise the approach in libssl. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Use uint32_t and int32_t for SSL_CIPHER structure.Dr. Stephen Henson2015-11-081-45/+42
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Change the DEFAULT ciphersuites to exclude DES, RC4 and RC2Matt Caswell2015-09-301-2/+18
| | | | | | | | | | | | | This patch updates the "DEFAULT" cipherstring to be "ALL:!COMPLEMENTOFDEFAULT:!eNULL". COMPLEMENTOFDEFAULT is now defined internally by a flag on each ciphersuite indicating whether it should be excluded from DEFAULT or not. This gives us control at an individual ciphersuite level as to exactly what is in DEFAULT and what is not. Finally all DES, RC4 and RC2 ciphersuites are added to COMPLEMENTOFDEFAULT and hence removed from DEFAULT. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Match SUITEB strings at start of cipher list.Dr. Stephen Henson2015-09-041-5/+6
| | | | | | PR#4009. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add and use OPENSSL_zallocRich Salz2015-09-021-2/+1
| | | | | | | | | There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
* ccm8 supportDr. Stephen Henson2015-08-141-5/+17
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* CCM support.Dr. Stephen Henson2015-08-141-6/+18
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove Gost94 signature algorithm.Rich Salz2015-08-111-10/+2
| | | | | | | This was obsolete in 2001. This is not the same as Gost94 digest. Thanks to Dmitry Belyavsky <beldmit@gmail.com> for review and advice. Reviewed-by: Matt Caswell <matt@openssl.org>
* Disable unsupported PSK algorithmsDr. Stephen Henson2015-07-301-4/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* new PSK text constantsDr. Stephen Henson2015-07-301-0/+9
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* New PSK aliases.Dr. Stephen Henson2015-07-301-1/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Tidy disabled algorithm handling.Dr. Stephen Henson2015-06-101-96/+73
| | | | | | | Determine disabled algorithm masks when algorithms are loaded instead of recalculating them each time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Restore GOST mac setup.Dr. Stephen Henson2015-06-101-0/+4
| | | | | | | Restore GOST mac setup which was accidentally removed during cipher refactor. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove Kerberos support from libsslMatt Caswell2015-05-131-37/+2
| | | | | | | Remove RFC2712 Kerberos support from libssl. This code and the associated standard is no longer considered fit-for-purpose. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make COMP_CTX and COMP_METHOD opaqueRich Salz2015-05-121-21/+25
| | | | | | | | | | | | | Since COMP_METHOD is now defined in comp_lcl.h, it is no longer possible to create new TLS compression methods without using the OpenSSL source. Only ZLIB is supported by default. Also, since the types are opaque, #ifdef guards to use "char *" instead of the real type aren't necessary. The changes are actually minor. Adding missing copyright to some files makes the diff misleadingly big. Reviewed-by: Matt Caswell <matt@openssl.org>
* Use "==0" instead of "!strcmp" etcRich Salz2015-05-061-8/+8
| | | | | | | For the various string-compare routines (strcmp, strcasecmp, str.*cmp) use "strcmp()==0" instead of "!strcmp()" Reviewed-by: Tim Hudson <tjh@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-051-2/+2
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use safer sizeof variant in mallocRich Salz2015-05-041-4/+4
| | | | | | | | | | | | | For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add OSSL_NELEM macro.Dr. Stephen Henson2015-05-031-2/+2
| | | | | | | Add OSSL_NELEM macro to e_os.h to determine the number of elements in an array. Reviewed-by: Tim Hudson <tjh@openssl.org>
* free NULL cleanup -- codaRich Salz2015-05-011-2/+1
| | | | | | | | After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* free null cleanup finaleRich Salz2015-05-011-1/+1
| | | | | | Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* remove malloc castsRich Salz2015-04-281-4/+3
| | | | | | | Following ANSI C rules, remove the casts from calls to OPENSSL_malloc and OPENSSL_realloc. Reviewed-by: Richard Levitte <levitte@openssl.org>
* SSL_CIPHER lookup functions.Dr. Stephen Henson2015-04-221-125/+95
| | | | | | | | | | | | | Add tables to convert between SSL_CIPHER fields and indices for ciphers and MACs. Reorganise ssl_ciph.c to use tables to lookup values and load them. New functions SSL_CIPHER_get_cipher_nid and SSL_CIPHER_get_digest_nid. Add documentation. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Code style: space after 'if'Viktor Dukhovni2015-04-161-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix missing return value checksMatt Caswell2015-03-231-1/+4
| | | | | | | | Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Merge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_ECRich Salz2015-03-111-6/+3
| | | | | | Suggested by John Foley <foleyj@cisco.com>. Reviewed-by: Matt Caswell <matt@openssl.org>
* Re-align some comments after running the reformat script.Matt Caswell2015-01-221-8/+8
| | | | | | | This should be a one off operation (subsequent invokation of the script should not move them) Reviewed-by: Tim Hudson <tjh@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-1787/+1794
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* More tweaks for comments due indent issuesmaster-pre-auto-reformatMatt Caswell2015-01-221-1/+2
| | | | | | | | | | | | Conflicts: ssl/ssl_ciph.c ssl/ssl_locl.h Conflicts: ssl/s2_srvr.c ssl/ssl.h Reviewed-by: Tim Hudson <tjh@openssl.org>
* mark all block comments that need format preserving so thatTim Hudson2014-12-301-6/+8
| | | | | | | indent will not alter them when reformatting comments Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Clear warnings/errors within KSSL_DEBUG code sectionsRichard Levitte2014-12-171-2/+2
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Clear warnings/errors within CIPHER_DEBUG code sectionsRichard Levitte2014-12-171-4/+4
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add more meaningful OPENSSL_NO_ECDH error message for suite b modeMatt Caswell2014-12-161-1/+1
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Add OPENSSL_NO_ECDH guardsMatt Caswell2014-12-161-0/+5
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* SSL_COMP_add_compression_method: exit if allocating the new compression ↵Jonas Maebe2014-12-101-0/+7
| | | | | | | method struct fails Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove some unnecessary OPENSSL_FIPS referencesDr. Stephen Henson2014-12-081-8/+0
| | | | | | FIPS_mode() exists in all versions of OpenSSL but always returns 0 if OpenSSL is not FIPS capable. Reviewed-by: Tim Hudson <tjh@openssl.org>
* ssl_create_cipher_list: check whether push onto cipherstack succeedsJonas Maebe2014-12-041-1/+6
| | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove SSLv2 supportKurt Roeckx2014-12-041-12/+4
| | | | | | The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT1815: More const'ness improvementsJustin Blanchard2014-08-181-1/+1
| | | | | | | | Add a dozen more const declarations where appropriate. These are from Justin; while adding his patch, I noticed ASN1_BIT_STRING_check could be fixed, too. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Use more common name for GOST key exchange.Dr. Stephen Henson2014-07-141-1/+1
|
* Add names of GOST algorithms.Peter Mosmans2014-07-131-0/+18
| | | | PR#3440
* Make disabling last cipher work.Thijs Alkemade2014-07-021-7/+11
|
* Fix off-by-one errors in ssl_cipher_get_evp()Miod Vallat2014-06-221-2/+2
| | | | | | | | In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays. Bug discovered and fixed by Miod Vallat from the OpenBSD team. PR#3375
* Revert "Fix off-by-one errors in ssl_cipher_get_evp()"Matt Caswell2014-06-221-2/+2
| | | | | | This reverts commit abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0. Incorrect attribution
* Fix off-by-one errors in ssl_cipher_get_evp()Kurt Cancemi2014-06-121-2/+2
| | | | | | In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays. PR#3375
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-22 15:12:40 +0000