aboutsummaryrefslogtreecommitdiffstats
path: root/util
Commit message (Collapse)AuthorAgeFilesLines
* TLSProxy: When in debug mode, show the exact subprocess commandsRichard Levitte2017-04-281-0/+6
| | | | | | | | When you want to debug a test that goes wrong, it's useful to know exactly what subprocess commands are run. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3342)
* Add support for SSL_SESSION_is_resumable()Matt Caswell2017-04-261-0/+1
| | | | | | | Provide a way to test whether the SSL_SESSION object can be used to resume a sesion or not. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3008)
* make updateDr. Stephen Henson2017-04-251-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3301)
* Switch command-line utils to new nameopt API.Dmitry Belyavskiy2017-04-251-0/+1
| | | | | | | | | | | | | | | | | The CA names should be printed according to user's decision print_name instead of set of BIO_printf dump_cert_text instead of set of BIO_printf Testing cyrillic output of X509_CRL_print_ex Write and use X509_CRL_print_ex Reduce usage of X509_NAME_online Using X509_REQ_print_ex instead of X509_REQ_print Fix nameopt processing. Make dump_cert_text nameopt-friendly Move nameopt getter/setter to apps/apps.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3262)
* Add a BIO_lookup_ex() functionMatt Caswell2017-04-251-0/+1
| | | | | | | | | | | | The existing BIO_lookup() wraps a call to getaddrinfo and provides an abstracted capability to lookup addresses based on socket type and family. However it provides no ability to lookup based on protocol. Normally, when dealing with TCP/UDP this is not required. However getaddrinfo (at least on linux) never returns SCTP addresses unless you specifically ask for them in the protocol field. Therefore BIO_lookup_ex() is added which provides the protocol field. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3286)
* Add CRYPTO_mem_leaks_cbRichard Levitte2017-04-241-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3243)
* Add -f -r flags to find-unused-errsRich Salz2017-04-161-1/+20
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3230)
* Fix util/mkdef.plRichard Levitte2017-04-101-18/+10
| | | | | | | | | | The deprecation checking code here didn't work the same way as in Configure, and used $config{options} to find an --api= option that was never there. This is replaced with checking $config{api}, which is the controlling variable for deprecation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Act on deprecation of LONG and ZLONG, step 3Richard Levitte2017-04-102-5/+25
| | | | | | | | | | | | | | | Teach util/mkdef.pl to recognise these lines: #if OPENSSL_API_COMPAT < 0xXXXXXXXXL #if OPENSSL_API_COMPAT >= 0xXXXXXXXXL and add corresponding markers in util/*.num A final 'make update' sets those markers right for LONG and ZLONG. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Publish our INT32, UINT32, INT64, UINT64 ASN.1 types and Z variantsRichard Levitte2017-04-101-1/+0
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Use 'over 2' for bullet lists.Rich Salz2017-04-071-1/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Standardize on =over 4 and check for it.Rich Salz2017-04-071-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Check for L<foo|foo>Rich Salz2017-04-071-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3117)
* Implement a new custom extensions APIMatt Caswell2017-04-071-0/+1
| | | | | | | | The old custom extensions API was not TLSv1.3 aware. Extensions are used extensively in TLSv1.3 and they can appear in many different types of messages. Therefore we need a new API to be able to cope with that. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3139)
* make updateRichard Levitte2017-04-041-0/+16
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* Implement internal ASN.1 types INT32, UINT32, INT64, UINT64Richard Levitte2017-04-041-0/+1
| | | | | | Also Z varieties. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3088)
* update ordinalsDr. Stephen Henson2017-04-031-0/+7
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3015)
* More typo fixesFdaSilvaYY2017-03-291-1/+1
| | | | | | | | Fix some comments too [skip ci] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3069)
* Look for comma before - in POD pagesRich Salz2017-03-231-0/+1
| | | | | | [skip ci] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3021)
* Fix find-doc-nits: { is significant in regexpsRichard Levitte2017-03-231-1/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3019)
* Add some HRR testsMatt Caswell2017-03-162-1/+5
| | | | | | | Check that we handle changes of ciphersuite between HRR and ServerHello correctly. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* HelloRetryRequest updates for draft-19Matt Caswell2017-03-161-0/+13
| | | | | | | | Draft-19 changes the HRR transcript hash so that the initial ClientHello is replaced in the transcript with a special synthetic message_hash message that just contains a hash of ClientHello1 as its message body. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* Update the TLSv1.3 version indicator for draft-19Matt Caswell2017-03-161-8/+8
| | | | | | | This change will mean we will lose interoperability with draft-18 implementations. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2895)
* Remove unused typedefs from indent configBenjamin Kaduk2017-03-161-42/+0
| | | | | | | | | | | | | | | | | Some things were not removed from util/indent.pro when they were removed from the code. grep '^-T' util/indent.pro | awk '{print $2} > /tmp/a grep -rF -f /tmp/a --exclude CHANGES --exclude 'INSTALL' --exclude 'LICENSE' --exclude 'NEWS' --exclude 'NOTES*' --exclude 'README*' --exclude indent.pro --exclude-dir corpora -o -h *|sort|uniq>/tmp/b comm -23 <(sort /tmp/a) /tmp/b >/tmp/c grep -v -E '(LHASH_OF|STACK_OF)' /tmp/c > /tmp/d grep -v -Ff /tmp/d util/indent.pro > util/indent.pro Manually adjusted to retain time_t and the ossl_*intmax_t types. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2797)
* Remove some unused PEM structuresBenjamin Kaduk2017-03-161-2/+0
| | | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2797)
* Forgotten 'make update'Richard Levitte2017-03-151-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix a hang in tests that use sessionfileMatt Caswell2017-03-151-12/+10
| | | | | | | | | | The logic for testing whether the sessionfile has been created or not was faulty and could result in race conditions. If you "lose" the tests hang waiting for a session file that's never going to arrive. Fixes #2950 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2955)
* VMS: don't use /DSF, turn off CALL_DEBUG insteadRichard Levitte2017-03-152-8/+6
| | | | | | | | | | | | | It turns out that /DSF didn't do any good for our purposes. Instead, remove the CALL_DEBUG flag from any image we link. This ensures that we can have debugging information in the image files, but don't automatically end up in a debugging session upon image activation. Unfortunately, this means the CALL_DEBUG must be turned on when there is a need to run with the debugger activated, and to turn it off when done. This has been documented in NOTES.VMS. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2957)
* VMS: throw away [.util]shareable_image_wrap.c.in and add replacement scriptsRichard Levitte2017-03-144-116/+61
| | | | | | | | | | | | | [.util]shareable_image_wrap.c.in was never useful because lib$spawn() insisted on combining stdout and stderr into one. Instead, we introduce two scripts that create and destroy a temporary environment where the local shareable images become available, [.util]local_shlib.com and [.util]unlocal_shlib.com. They also define DBG$IMAGE_DSF_PATH, which is require so the debugger can find the Debug Symbol Files. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2947)
* Fix some doc nitsRich Salz2017-03-121-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2909)
* Fix many doc L<> errorsRich Salz2017-03-112-102/+87
| | | | | | | | | | | | | | | | | Add 2017 copyright year Add missing typedef to NAME Remove ec(7) and bn(7) doc links Remove .pod link errors, bogus links, make a few typo corrections Fix some typo's in links and some missing items. Don't link to C runtime functions (See OPENSSL_malloc for example/precedent) Document ASN1_tag2str(), add a few typedef's that were missing from NAME Update doc-nits target; addresses https://github.com/openssl/openssl/pull/1900#issuecomment-259943891, Merge check-doc-links into find-doc-nits; if run regularly, would have found https://github.com/openssl/openssl/pull/2825 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2862)
* Add a test to check that if a PSK extension is not last then we failMatt Caswell2017-03-102-10/+31
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2896)
* util/process_docs.pl: make it possible to add a suffix to man docsRichard Levitte2017-03-061-1/+12
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2863)
* Add a test for TLSv1.3 cookiesMatt Caswell2017-03-041-0/+1
| | | | | | | | We just check that if we insert a cookie into an HRR it gets echoed back in the subsequent ClientHello. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2839)
* Rename SSL_write_early() to SSL_write_early_data()Matt Caswell2017-03-021-1/+1
| | | | | | | This is for consistency with the rest of the API where all the functions are called *early_data*. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Rename SSL_read_early() to SSL_read_early_data()Matt Caswell2017-03-021-1/+1
| | | | | | | This is for consistency with the rest of the API where all the functions are called *early_data*. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Make SSL_write_early_finish() an internal only functionMatt Caswell2017-03-021-4/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Add a SSL_SESSION_get_max_early_data() functionMatt Caswell2017-03-021-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Construct the server side early_data extensionMatt Caswell2017-03-021-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Provide an SSL_read_early() function for reading early dataMatt Caswell2017-03-021-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Provide functions to write early dataMatt Caswell2017-03-021-0/+2
| | | | | | | | We provide SSL_write_early() which *must* be called first on a connection (prior to any other IO function including SSL_connect()/SSL_do_handshake()). Also SSL_write_early_finish() which signals the end of early data. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Construct the ticket_early_data_info extensionMatt Caswell2017-03-021-0/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2737)
* Code health: make updateRichard Levitte2017-02-281-11/+11
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2793)
* Code health: Remove VAX exceptions in util/mkdef.plRichard Levitte2017-02-281-29/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2793)
* More Configure cleanup. RemoveEmilia Kasper2017-02-282-569/+0
| | | | | | | | - util/incore - util/fipslink.pl - the unused "baseaddr" configure switch Reviewed-by: Stephen Henson <steve@openssl.org>
* Add a null UI methodRichard Levitte2017-02-261-0/+1
| | | | | | | | | | There are cases when, if you pass a NULL UI_METHOD, the called function will use an internal default. This is well and good, but there may be cases when this is undesirable and one would rather send in a UI that does absolutely nothing (sort of a /dev/null). UI_null() is the UI_METHOD for this purpose. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2744)
* Add SSL_CTX early callbackBenjamin Kaduk2017-02-231-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Provide a callback interface that gives the application the ability to adjust the nascent SSL object at the earliest stage of ClientHello processing, immediately after extensions have been collected but before they have been processed. This is akin to BoringSSL's "select_certificate_cb" (though it is not API compatible), and as the name indicates, one major use is to examine the supplied server name indication and select what certificate to present to the client. However, it can also be used to make more sweeping configuration changes to the SSL object according to the selected server identity and configuration. That may include adjusting the permitted TLS versions, swapping out the SSL_CTX object (as is traditionally done in a tlsext_servername_callback), changing the server's cipher list, and more. We also wish to allow an early callback to indicate that it needs to perform additional work asynchronously and resume processing later. To that effect, refactor the second half of tls_process_client_hello() into a subroutine to be called at the post-processing stage (including the early callback itself), to allow the callback to result in remaining in the same work stage for a later call to succeed. This requires allocating for and storing the CLIENTHELLO_MSG in the SSL object to be preserved across such calls, but the storage is reclaimed after ClientHello processing finishes. Information about the CliehtHello is available to the callback by means of accessor functions that can only be used from the early callback. This allows extensions to make use of the existing internal parsing machinery without exposing structure internals (e.g., of PACKET), so that applications do not have to write fragile parsing code. Applications are encouraged to utilize an early callback and not use a servername_callback, in order to avoid unexpected behavior that occurs due to the relative order of processing between things like session resumption and the historical servername callback. Also tidy up nearby style by removing unnecessary braces around one-line conditional bodies. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
* Export SSL_bytes_to_cipher_list()Benjamin Kaduk2017-02-231-0/+1
| | | | | | | | | | | | | | | | | Move ssl_bytes_to_cipher_list() to ssl_lib.c and create a public wrapper around it. This lets application early callbacks easily get SSL_CIPHER objects from the raw ciphers bytes without having to reimplement the parsing code. In particular, they do not need to know the details of the sslv2 format ClientHello's ciphersuite specifications. Document the new public function, including the arguably buggy behavior of modifying the supplied SSL object. On the face of it, such a function should be able to be pure, just a direct translation of wire octets to internal data structures. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
* Implementation of the ARIA cipher as described in RFC 5794.Pauli2017-02-212-1/+22
| | | | | | | | | | | | | | This implementation is written in endian agnostic C code. No attempt at providing machine specific assembly code has been made. This implementation expands the evptests by including the test cases from RFC 5794 and ARIA official site rather than providing an individual test case. Support for ARIA has been integrated into the command line applications, but not TLS. Implemented modes are CBC, CFB1, CFB8, CFB128, CTR, ECB and OFB128. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2337)
* Add a SSL_get_key_update_type() functionMatt Caswell2017-02-171-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2609)
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-02 05:16:06 +0000