aboutsummaryrefslogtreecommitdiffstats
path: root/util/ssleay.num
Commit message (Collapse)AuthorAgeFilesLines
* Make SSL_set_debug deprecated in 1.1Rich Salz2016-01-141-1/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT4232: Extra space in help message.Rich Salz2016-01-141-1/+1
| | | | | | | | | It turns out that -pause calls the undocumented function SSL_set_debug. That just sets flag inside the SSL structure. That flag, despite the command is never used. So remove the flag, the field, and the function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make SSL{_CTX,}_{get,set,clear}_options functionsViktor Dukhovni2016-01-111-0/+6
| | | | | | | These now take and return unsigned long, and get is constified. Updated related documentation and util/ssleay.num Reviewed-by: Matt Caswell <matt@openssl.org>
* DANE make updateViktor Dukhovni2016-01-061-0/+11
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* make updateDr. Stephen Henson2015-12-221-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't export internal symbolsMatt Caswell2015-12-151-415/+415
| | | | | | | | | | | On Linux when creating the .so file we were exporting all symbols. We should only be exporting public symbols. This commit fixes the issue. It is only applicable to linux currently although the same technique may work for other platforms (e.g. Solaris should work the same way). This also adds symbol version information to our exported symbols. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove support for all 40 and 56 bit ciphers.Kurt Roeckx2015-12-051-2/+2
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
* Remove support for SSL_{CTX_}set_tmp_ecdh_callback().Kurt Roeckx2015-12-041-2/+2
| | | | | | | | This only gets used to set a specific curve without actually checking that the peer supports it or not and can therefor result in handshake failures that can be avoided by selecting a different cipher. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* ex_data part 2: doc fixes and CRYPTO_free_ex_index.Rich Salz2015-12-011-3/+3
| | | | | | | | | | Add CRYPTO_free_ex_index (for shared libraries) Unify and complete the documentation for all "ex_data" API's and objects. Replace xxx_get_ex_new_index functions with a macro. Added an exdata test. Renamed the ex_data internal datatypes. Reviewed-by: Matt Caswell <matt@openssl.org>
* make updateMatt Caswell2015-11-201-0/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix SSL_use_certificate_chain_fileMatt Caswell2015-11-101-0/+2
| | | | | | | | | The new function SSL_use_certificate_chain_file was always crashing in the internal function use_certificate_chain_file because it would pass a NULL value for SSL_CTX *, but use_certificate_chain_file would unconditionally try to dereference it. Reviewed-by: Stephen Henson <steve@openssl.org>
* make updateMatt Caswell2015-10-301-2/+3
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* make updateMatt Caswell2015-10-301-0/+3
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-stdio buildDavid Woodhouse2015-09-291-15/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Much related/similar work also done by Ivan Nestlerode <ivan.nestlerode@sonos.com> +Replace FILE BIO's with dummy ops that fail. +Include <stdio.h> for sscanf() even with no-stdio (since the declaration is there). We rely on sscanf() to parse the OPENSSL_ia32cap environment variable, since it can be larger than a 'long'. And we don't rely on the availability of strtoull(). +Remove OPENSSL_stderr(); not used. +Make OPENSSL_showfatal() do nothing (currently without stdio there's nothing we can do). +Remove file-based functionality from ssl/. The function prototypes were already gone, but not the functions themselves. +Remove unviable conf functionality via SYS_UEFI +Add fallback definition of BUFSIZ. +Remove functions taking FILE * from header files. +Add missing DECLARE_PEM_write_fp_const +Disable X509_LOOKUP_hash_dir(). X509_LOOKUP_file() was already compiled out, so remove its prototype. +Use OPENSSL_showfatal() in CRYPTO_destroy_dynlockid(). +Eliminate SRP_VBASE_init() and supporting functions. Users will need to build the verifier manually instead. +Eliminate compiler warning for unused do_pk8pkey_fp(). +Disable TEST_ENG_OPENSSL_PKEY. +Disable GOST engine as is uses [f]printf all over the place. +Eliminate compiler warning for unused send_fp_chars(). Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add ability to set default CA path and file locations individuallyMatt Caswell2015-09-251-0/+2
| | | | | | | Previously you could only set both the default path and file locations together. This adds the ability to set one without the other. Reviewed-by: Andy Polyakov <appro@openssl.org>
* make updateDr. Stephen Henson2015-06-291-4/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Change return type of the new accessorsMatt Caswell2015-05-281-0/+4
| | | | | | | | The new accessors SSL_get_client_random, SSL_get_server_random and SSL_SESSION_get_master_key should return a size_t to match the type of the |outlen| parameter. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove support for OPENSSL_NO_TLSEXTMatt Caswell2015-05-221-12/+12
| | | | | | | | | | Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Client side version negotiation rewriteMatt Caswell2015-05-161-1/+2
| | | | | | | | | | Continuing from the previous commit this changes the way we do client side version negotiation. Similarly all of the s23* "up front" state machine code has been avoided and again things now work much the same way as they already did for DTLS, i.e. we just do most of the work in the ssl3_get_server_hello() function. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Server side version negotiation rewriteMatt Caswell2015-05-161-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit changes the way that we do server side protocol version negotiation. Previously we had a whole set of code that had an "up front" state machine dedicated to the negotiating the protocol version. This adds significant complexity to the state machine. Historically the justification for doing this was the support of SSLv2 which works quite differently to SSLv3+. However, we have now removed support for SSLv2 so there is little reason to maintain this complexity. The one slight difficulty is that, although we no longer support SSLv2, we do still support an SSLv3+ ClientHello in an SSLv2 backward compatible ClientHello format. This is generally only used by legacy clients. This commit adds support within the SSLv3 code for these legacy format ClientHellos. Server side version negotiation now works in much the same was as DTLS, i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to that then when a ClientHello is received it will work out the most appropriate version to respond with. Also, SSLv23_method and SSLv23_server_method have been replaced with TLS_method and TLS_server_method respectively. The old SSLv23* names still exist as macros pointing at the new name, although they are deprecated. Subsequent commits will look at client side version negotiation, as well of removal of the old s23* code. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove Kerberos support from libsslMatt Caswell2015-05-131-17/+17
| | | | | | | Remove RFC2712 Kerberos support from libssl. This code and the associated standard is no longer considered fit-for-purpose. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make COMP_CTX and COMP_METHOD opaqueRich Salz2015-05-121-10/+10
| | | | | | | | | | | | | Since COMP_METHOD is now defined in comp_lcl.h, it is no longer possible to create new TLS compression methods without using the OpenSSL source. Only ZLIB is supported by default. Also, since the types are opaque, #ifdef guards to use "char *" instead of the real type aren't necessary. The changes are actually minor. Adding missing copyright to some files makes the diff misleadingly big. Reviewed-by: Matt Caswell <matt@openssl.org>
* Add SSL_use_certificate_chain_file functionDr. Stephen Henson2015-05-081-0/+1
| | | | | | | | | | | Add SSL_use_certiicate_chain file functions: this is works the same way as SSL_CTX_use_certificate_chain_file but for an SSL structure. Update SSL_CONF code to use the new function. Update docs. Update ordinals. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Big apps cleanup (option-parsing, etc)Rich Salz2015-04-241-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
* Update ordinals, fix error message.Dr. Stephen Henson2015-03-151-2/+7
| | | | | | | | | Update error messages to say "EC is disabled" these can then be picked up by mkdef.pl. Update ordinals. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Fix various build breaksRich Salz2015-02-041-16/+18
| | | | | | | | | | | TABLE wasn't updated from a previous Configure change Missed an RMD160/RIPE/RIPEMD unification in mkdef.pl Makefile install_sw referenced file doc/openssl-shared.txt (RT3686) Needed to run 'make update' because - Various old code has been removed - Varous old #ifdef tests were removed Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove SSLv2 supportKurt Roeckx2014-12-041-3/+3
| | | | | | The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: Richard Levitte <levitte@openssl.org>
* New option no-ssl3-method which removes SSLv3_*methodDr. Stephen Henson2014-11-191-3/+3
| | | | | | | | | | | When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3 options for s_client/s_server/ssltest. When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3 options. We should document this somewhere, e.g. wiki, FAQ or manual page. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix SRTP compile issues for windowsMatt Caswell2014-10-151-4/+4
| | | | | | | | | | | | Related to CVE-2014-3513 This fix was developed by the OpenSSL Team Reviewed-by: Tim Hudson <tjh@openssl.org> Conflicts: util/mkdef.pl util/ssleay.num
* sync ordinals with 1.0.2Dr. Stephen Henson2014-09-051-60/+65
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add conditional unit testing interface.Dr. Stephen Henson2014-07-241-0/+1
| | | | | | | | | | | Don't call internal functions directly call them through SSL_test_functions(). This also makes unit testing work on Windows and platforms that don't export internal functions from shared libraries. By default unit testing is not enabled: it requires the compile time option "enable-unit-test". Reviewed-by: Geoff Thorpe <geoff@openssl.org>
* Windows build fixes.Dr. Stephen Henson2014-07-191-0/+55
| | | | | | | Add cmac.h to mkdef.pl Remove ENGINE_load_rsax from engine.h: no longer built. Update ordinals Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix compilation with no-nextprotoneg.Piotr Sikora2013-11-141-1/+1
| | | | PR#3106
* Update ordinals.Dr. Stephen Henson2012-04-031-0/+1
|
* delete unimplemented function from header file, update ordinalsDr. Stephen Henson2011-12-231-1/+1
|
* sync and update ordinalsDr. Stephen Henson2011-12-221-9/+10
|
* sync and update ordinalsDr. Stephen Henson2011-11-211-10/+15
|
* Sync ordinals.Dr. Stephen Henson2011-05-111-10/+24
|
* make update (1.1.0-dev)Richard Levitte2011-03-231-24/+40
| | | | | | This meant alarger renumbering in util/libeay.num due to symbols appearing in 1.0.0-stable and 1.0.1-stable. However, since there's been no release on this branch yet, it should be harmless.
* Add SRP support.Ben Laurie2011-03-121-0/+14
|
* make updateBodo Möller2011-02-031-2/+8
|
* sync and update ordinalsDr. Stephen Henson2010-08-261-3/+9
|
* make updateDr. Stephen Henson2010-01-151-0/+3
|
* Make update.Dr. Stephen Henson2009-07-081-0/+2
|
* Updates from 1.0.0-stable.Dr. Stephen Henson2009-04-151-3/+3
|
* Update from 1.0.0-stableDr. Stephen Henson2009-03-311-2/+3
|
* PR: 1574Dr. Stephen Henson2008-11-151-0/+2
| | | | | | | Submitted by: Jouni Malinen <j@w1.fi> Approved by: steve@openssl.org Ticket override support for EAP-FAST.
* Sync ordinals with stable branch.Dr. Stephen Henson2008-06-051-15/+15
|
* Update ordinals.Dr. Stephen Henson2008-06-041-2/+3
|
* Update ssl code to support digests other than MD5+SHA1 in handshake.Dr. Stephen Henson2007-08-311-13/+13
| | | | Submitted by: Victor B. Wagner <vitus@cryptocom.ru>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-02 10:52:40 +0000