aboutsummaryrefslogtreecommitdiffstats
path: root/ssl
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "Fix an error code spelling."Rich Salz2016-04-042-2/+2
| | | | | | | This reverts commit 2b0bcfaf834e2fb7cd52888d7330b247e3878115. It wasn't reviewed. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix an error code spelling.FdaSilvaYY2016-04-042-2/+2
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* various spelling fixesFdaSilvaYY2016-04-0412-24/+25
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-031-11/+14
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Use return "" not set a var and return.Rich Salz2016-03-312-305/+146
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* RT4458: Fix #ifndef line for GOSTPauli2016-03-311-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make BIO opaqueMatt Caswell2016-03-292-60/+64
| | | | | | | | Move the the BIO_METHOD and BIO structures into internal header files, provide appropriate accessor methods and update all internal code to use the new accessors where appropriate. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Resolve DTLS cookie and version before session resumption.David Benjamin2016-03-271-33/+32
| | | | | | | | | | | | | | | Session resumption involves a version check, so version negotiation must happen first. Currently, the DTLS implementation cannot do session resumption in DTLS 1.0 because the ssl_version check always checks against 1.2. Switching the order also removes the need to fixup ssl_version in DTLS version negotiation. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> RT: #4392, MR: #2452
* Allow different protocol version when trying to reuse a sessionFedor Indutny2016-03-276-167/+86
| | | | | | | | | | | | | | | | | We now send the highest supported version by the client, even if the session uses an older version. This fixes 2 problems: - When you try to reuse a session but the other side doesn't reuse it and uses a different protocol version the connection will fail. - When you're trying to reuse a session with an old version you might be stuck trying to reuse the old version while both sides support a newer version Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #852, MR: #2452
* Check algo_strength using SSL_STRONG_MASKKurt Roeckx2016-03-222-6/+10
| | | | | | | | algo_strength contains 2 parts that need to be checked by their own. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #2082
* Move declaration of i into blocks where it is used.Ben Laurie2016-03-221-3/+7
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* RT4660: BIO_METHODs should be const.David Benjamin2016-03-211-2/+2
| | | | | | | BIO_new, etc., don't need a non-const BIO_METHOD. This allows all the built-in method tables to live in .rodata. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-sockMatt Caswell2016-03-211-1/+2
| | | | | | Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove the remainder of util/mk1mf.pl and companion scriptsRichard Levitte2016-03-211-3/+0
| | | | | | | This removes all scripts that deal with MINFO as well, since that's only used by mk1mf. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Fix ALPN - more fixesTodd Short2016-03-201-6/+9
| | | | | | | | | | * Clear proposed, along with selected, before looking at ClientHello * Add test case for above * Clear NPN seen after selecting ALPN on server * Minor documentation updates Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove #error from include files.Rich Salz2016-03-2012-61/+21
| | | | | | | | Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Ensure that memory allocated for the ticket is freedMatt Caswell2016-03-181-0/+1
| | | | | | | | | If a call to EVP_DecryptUpdate fails then a memory leak could occur. Ensure that the memory is freed appropriately. Issue reported by Guido Vranken. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove Netware and OS/2Rich Salz2016-03-171-2/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Report TLS 1.0 as backwards-compatible TLSv1Viktor Dukhovni2016-03-172-1/+8
| | | | | | | The TLSv1.0 form is retained for reporting the first protocol version that supports a given cupher. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Sort cipher-list at runtime.Rich Salz2016-03-163-1528/+1227
| | | | | | Reduces #ifdef complexity. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix no-comp buildEmilia Kasper2016-03-121-1/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* check reviewer --reviewer=emiliaRob Percival2016-03-101-0/+11
| | | | | | | | | | | | Remove 'log' field from SCT and related accessors In order to still have access to an SCT's CTLOG when calling SCT_print, SSL_CTX_get0_ctlog_store has been added. Improved documentation for some CT functions in openssl/ssl.h. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate the use of version-specific methodsKurt Roeckx2016-03-094-45/+170
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
* Move disabling of RC4 for DTLS to the cipher list.Kurt Roeckx2016-03-094-46/+35
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Remove DES cipher aliasKurt Roeckx2016-03-091-1/+0
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* IDEA is not supported in TLS 1.2Kurt Roeckx2016-03-091-2/+2
| | | | | | | | | This currently seems to be the only cipher we still support that should get disabled. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Add support for minimum and maximum protocol version supported by a cipherKurt Roeckx2016-03-098-318/+504
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Add ssl_get_client_min_max_version() functionKurt Roeckx2016-03-092-18/+44
| | | | | | | | | Adjust ssl_set_client_hello_version to get both the minimum and maximum and then make ssl_set_client_hello_version use the maximum version. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Make SSL_CIPHER_get_version return a const char *Kurt Roeckx2016-03-091-1/+1
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Remove unused codeKurt Roeckx2016-03-091-15/+4
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Make function to convert version to stringKurt Roeckx2016-03-093-32/+24
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Constify security callbacksKurt Roeckx2016-03-093-12/+12
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Do not display a CT log error message if CT validation is disabledRob Percival2016-03-091-5/+1
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix locking in ssl_cert_dup()Todd Short2016-03-091-1/+1
| | | | | | | Properly check the return value of CRYPTO_THREAD_lock_new() Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Counter mixed signedness with a castRichard Levitte2016-03-091-2/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix SSL_CIPHER_get_auth_nid returnTodd Short2016-03-081-1/+1
| | | | | | | | Copy/paste error between SSL_CIPHER_get_kx_nid() and SSL_CIPHER_get_auth_nid(), wrong table was referenced Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Convert CRYPTO_LOCK_SSL_* to new multi-threading APIAlessandro Ghedini2016-03-085-104/+150
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Convert CRYPTO_LOCK_X509_* to new multi-threading APIAlessandro Ghedini2016-03-081-4/+3
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Convert CRYPTO_LOCK_BIO to new multi-threading APIAlessandro Ghedini2016-03-081-3/+3
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-081-7/+7
| | | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add cipher query functionsTodd Short2016-03-081-4/+48
| | | | | | | Add functions to determine authentication, key-exchange, FIPS and AEAD. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH815: The ChaCha20/Poly1305 codepoints are officialBenjamin Kaduk2016-03-081-1/+1
| | | | | | | | | | CCA8, CCA9, CCAA, CCAB, CCAC, CCAD, and CCAE are now present in https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml so remove the "as per draft-ietf-tls-chacha20-poly1305-03" note accordingly. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-084-48/+68
| | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix building without multiblock supportMatt Caswell2016-03-081-2/+2
| | | | | | | | | Not all platforms support multiblock. Building without it fails prior to this fix. RT#4396 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rename the numpipes argument to ssl3_enc/tls1_encMatt Caswell2016-03-072-22/+25
| | | | | | | | The numpipes argument to ssl3_enc/tls1_enc is actually the number of records passed in the array. To make this clearer rename the argument to |n_recs|. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Rename a functionMatt Caswell2016-03-071-2/+2
| | | | | | | Rename the have_whole_app_data_record_waiting() function to include the ssl3_record prefix...and make it a bit shorter. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove the wrec record layer fieldMatt Caswell2016-03-074-32/+25
| | | | | | | | | We used to use the wrec field in the record layer for keeping track of the current record that we are writing out. As part of the pipelining changes this has been moved to stack allocated variables to do the same thing, therefore the field is no longer needed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Update a commentMatt Caswell2016-03-071-2/+2
| | | | | | Update a comment that was out of date due to the pipelining changes Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix erroneous fall thgrough in switch statementMatt Caswell2016-03-071-0/+2
| | | | | | Fix an erroenous fall through when setting the max_pipelines value. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add an SSL_has_pending() functionMatt Caswell2016-03-073-4/+20
| | | | | | | | | | | | | | This is similar to SSL_pending() but just returns a 1 if there is data pending in the internal OpenSSL buffers or 0 otherwise (as opposed to SSL_pending() which returns the number of bytes available). Unlike SSL_pending() this will work even if "read_ahead" is set (which is the case if you are using read pipelining, or if you are doing DTLS). A 1 return value means that we have unprocessed data. It does *not* necessarily indicate that there will be application data returned from a call to SSL_read(). The unprocessed data may not be application data or there could be errors when we attempt to parse the records. Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-05 11:14:54 +0000