aboutsummaryrefslogtreecommitdiffstats
path: root/util
Commit message (Collapse)AuthorAgeFilesLines
* Find the right indent on *BSD.Ben Laurie2015-08-101-3/+6
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* GH336: Return an exit code if report failsDirk Wetter2015-08-011-0/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rewrite crypto/ex_dataRich Salz2015-07-201-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removed ability to set ex_data impl at runtime. This removed these three functions: const CRYPTO_EX_DATA_IMPL *CRYPTO_get_ex_data_implementation(void); int CRYPTO_set_ex_data_implementation(const CRYPTO_EX_DATA_IMPL *i); int CRYPTO_ex_data_new_class(void); It is no longer possible to change the ex_data implementation at runtime. (Luckily those functions were never documented :) Also removed the ability to add new exdata "classes." We don't believe this received much (if any) use, since you can't add it to OpenSSL objects, and there are probably better (native) methods for developers to add their own extensible data, if they really need that. Replaced the internal hash table (of per-"class" stacks) with a simple indexed array. Reserved an index for "app" application. Each API used to take the lock twice; now it only locks once. Use local stack storage for function pointers, rather than malloc, if possible (i.e., number of ex_data items is under a dozen). Make CRYPTO_EX_DATA_FUNCS opaque/internal. Also fixes RT3710; index zero is reserved. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove obsolete key formats.Rich Salz2015-07-161-10/+10
| | | | | | | | Remove support for RSA_NET and Netscape key format (-keyform n). Also removed documentation of SGC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH322: Fix typo in generated comment.Ernie Hershey2015-07-151-1/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Conversion to UTF-8 where neededRichard Levitte2015-07-141-1/+1
| | | | | | | | This leaves behind files with names ending with '.iso-8859-1'. These should be safe to remove. If something went wrong when re-encoding, there will be some files with names ending with '.utf8' left behind. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Small script to re-encode files that need it to UTF-8Richard Levitte2015-07-141-0/+17
| | | | | | This requires 'iconv' and that 'file' can take the options '-b' and '-i'. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Sort @sstacklst correctly.Dr. Stephen Henson2015-07-091-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Apply some missing updates from previous commitsMatt Caswell2015-07-091-0/+1
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* make updateDr. Stephen Henson2015-06-291-4/+4
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* More secure storage of key material.Rich Salz2015-06-231-0/+14
| | | | | | | | | Add secure heap for storage of private keys (when possible). Add BIO_s_secmem(), CBIGNUM, etc. Add BIO_CTX_secure_new so all BIGNUM's in the context are secure. Contributed by Akamai Technologies under the Corporate CLA. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Properly check certificate in case of export ciphers.Kurt Roeckx2015-06-091-0/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> MR #588
* make update.Dr. Stephen Henson2015-06-031-2/+2
| | | | | | | Make update with manual edit so EVP_PKEY_asn1_set_item uses the same ordinal as 1.0.2. Reviewed-by: Matt Caswell <matt@openssl.org>
* Change return type of the new accessorsMatt Caswell2015-05-281-0/+4
| | | | | | | | The new accessors SSL_get_client_random, SSL_get_server_random and SSL_SESSION_get_master_key should return a size_t to match the type of the |outlen| parameter. Reviewed-by: Richard Levitte <levitte@openssl.org>
* make updateDr. Stephen Henson2015-05-261-0/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove support for OPENSSL_NO_TLSEXTMatt Caswell2015-05-223-18/+14
| | | | | | | | | | Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* make updateDr. Stephen Henson2015-05-211-0/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* make updateDr. Stephen Henson2015-05-201-0/+5
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* GitHub284: Fix typo in xx-32.pl scripts.StudioEtrange2015-05-202-3/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add types to indent.proDr. Stephen Henson2015-05-171-0/+8
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Client side version negotiation rewriteMatt Caswell2015-05-161-1/+2
| | | | | | | | | | Continuing from the previous commit this changes the way we do client side version negotiation. Similarly all of the s23* "up front" state machine code has been avoided and again things now work much the same way as they already did for DTLS, i.e. we just do most of the work in the ssl3_get_server_hello() function. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Server side version negotiation rewriteMatt Caswell2015-05-161-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit changes the way that we do server side protocol version negotiation. Previously we had a whole set of code that had an "up front" state machine dedicated to the negotiating the protocol version. This adds significant complexity to the state machine. Historically the justification for doing this was the support of SSLv2 which works quite differently to SSLv3+. However, we have now removed support for SSLv2 so there is little reason to maintain this complexity. The one slight difficulty is that, although we no longer support SSLv2, we do still support an SSLv3+ ClientHello in an SSLv2 backward compatible ClientHello format. This is generally only used by legacy clients. This commit adds support within the SSLv3 code for these legacy format ClientHellos. Server side version negotiation now works in much the same was as DTLS, i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to that then when a ClientHello is received it will work out the most appropriate version to respond with. Also, SSLv23_method and SSLv23_server_method have been replaced with TLS_method and TLS_server_method respectively. The old SSLv23* names still exist as macros pointing at the new name, although they are deprecated. Subsequent commits will look at client side version negotiation, as well of removal of the old s23* code. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Update mkdef for moved header file.Rich Salz2015-05-141-1/+1
| | | | | | | crypto/cryptlib.h moved to crypto/include/internal; update the script. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Adjust unixly mk1mf after introduction of tkeyRichard Levitte2015-05-141-0/+6
| | | | | | | | Added depencies on the public variants of some keys in test to Makefile. Added the newly introduced key files from test/ in the list of files to copy in util/pl/unix.pl. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Identify and move OpenSSL internal header filesRichard Levitte2015-05-141-2/+2
| | | | | | | | | | | | | | There are header files in crypto/ that are used by the rest of OpenSSL. Move those to include/internal and adapt the affected source code, Makefiles and scripts. The header files that got moved are: crypto/constant_time_locl.h crypto/o_dir.h crypto/o_str.h Reviewed-by: Matt Caswell <matt@openssl.org>
* util/incore update.Andy Polyakov2015-05-131-2/+5
| | | | | | | Support cross-compile platforms that don't support FINGERPRINT_premain, e.g. VxWorks. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove remaining Kerberos referencesMatt Caswell2015-05-137-134/+68
| | | | | | | Following on from the removal of libcrypto and libssl support for Kerberos this commit removes all remaining references to Kerberos. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove Kerberos support from libsslMatt Caswell2015-05-133-20/+17
| | | | | | | Remove RFC2712 Kerberos support from libssl. This code and the associated standard is no longer considered fit-for-purpose. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make COMP_CTX and COMP_METHOD opaqueRich Salz2015-05-122-10/+14
| | | | | | | | | | | | | Since COMP_METHOD is now defined in comp_lcl.h, it is no longer possible to create new TLS compression methods without using the OpenSSL source. Only ZLIB is supported by default. Also, since the types are opaque, #ifdef guards to use "char *" instead of the real type aren't necessary. The changes are actually minor. Adding missing copyright to some files makes the diff misleadingly big. Reviewed-by: Matt Caswell <matt@openssl.org>
* Add SSL_use_certificate_chain_file functionDr. Stephen Henson2015-05-081-0/+1
| | | | | | | | | | | Add SSL_use_certiicate_chain file functions: this is works the same way as SSL_CTX_use_certificate_chain_file but for an SSL structure. Update SSL_CONF code to use the new function. Update docs. Update ordinals. Reviewed-by: Rich Salz <rsalz@openssl.org>
* make updateRichard Levitte2015-05-051-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* free cleanup almost the finaleRich Salz2015-04-301-0/+2
| | | | | | | | | | Add OPENSSL_clear_free which merges cleanse and free. (Names was picked to be similar to BN_clear_free, etc.) Removed OPENSSL_freeFunc macro. Fixed the small simple ones that are left: CRYPTO_free CRYPTO_free_locked OPENSSL_free_locked Reviewed-by: Richard Levitte <levitte@openssl.org>
* ERR_ cleanupRich Salz2015-04-282-3/+2
| | | | | | | | | | | | Remove ERR_[gs]et_implementation as they were not undocumented and useless (the data structure was opaque). Halve the number of lock/unlock calls in almost all ERR_ functions by letting the caller of get_hash or int_thread_set able to lock. Very useful when looping, such as adding errors, or when getting the hash and immediately doing a lookup on it. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Allow for types with leading underscore when checking error macros.Richard Levitte2015-04-281-1/+1
| | | | | | | | We have an increasing number of function declarations starting with '__owur'. Unfortunately, util/ck_errf.pl fails to detect them. A simple change fixes that issue. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix the check of test apps in util/mk1mf.plRichard Levitte2015-04-271-2/+9
| | | | | | | | The previous check assumed that the variables for each test app, ending with TEST would be indication enough. Experience showed that this isn't the best way. Instead, simply look for the EXE variable in test/Makefile. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Small fixes after the Big apps cleanupRichard Levitte2015-04-271-1/+1
| | | | | | | This fixes util/mk1mf.pl, which was looking for old variable names from apps/Makefile. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Big apps cleanup (option-parsing, etc)Rich Salz2015-04-242-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
* Have mkerr.pl treat already existing multiline string defs properlyRichard Levitte2015-04-081-7/+14
| | | | | | | | | | | | | | | | | | | | | Since source reformat, we ended up with some error reason string definitions that spanned two lines. That in itself is fine, but we sometimes edited them to provide better strings than what could be automatically determined from the reason macro, for example: {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER), "Peer haven't sent GOST certificate, required for selected ciphersuite"}, However, mkerr.pl didn't treat those two-line definitions right, and they ended up being retranslated to whatever the macro name would indicate, for example: {ERR_REASON(SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER), "No gost certificate sent by peer"}, Clearly not what we wanted. This change fixes this problem. Reviewed-by: Matt Caswell <matt@openssl.org>
* Drop CA.sh for CA.plRich Salz2015-04-081-2/+2
| | | | | | Remove CA.sh script and use CA.pl for testing, etc. Reviewed-by: Richard Levitte <levitte@openssl.org>
* update ordinalsDr. Stephen Henson2015-04-031-4/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* remove asn1_mac.hDr. Stephen Henson2015-04-031-1/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Now that we've removed the need for symlinks, we can safely remove ↵Richard Levitte2015-03-311-73/+0
| | | | | | util/mklinks.pl Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove remaining variables for symlinked/copied headers and testsRichard Levitte2015-03-314-42/+10
| | | | | | | | | | | GitConfigure: no more 'no-symlinks' util/bat.sh, util/mk1mf.pl, util/pl/VC-32.pl, util/pl/unix.pl: - Remove all uses of EXHEADER. That includes removing the use if INC_D and INCO_D. - Replace the check for TEST with a check for [A-Z0-9_]*TEST. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Stop symlinking, move files to intended directoryRichard Levitte2015-03-312-71/+71
| | | | | | | | | | | | | Rather than making include/openssl/foo.h a symlink to crypto/foo/foo.h, this change moves the file to include/openssl/foo.h once and for all. Likewise, move crypto/foo/footest.c to test/footest.c, instead of symlinking it there. Originally-by: Geoff Thorpe <geoff@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix some faults in util/mk1mf.plRichard Levitte2015-03-312-5/+8
| | | | | | | | | | | | | When building on Unix, there are times when the 'EX_LIB' MINFO variable contains valuable information. Make sure to take care of it. fixrules in util/pl/unix.pl was previously changed with a simpler fix of rules, with a comment claiming that's compatible with -j. Unfortunately, this breaks multiline rules and doesn't change anything for single line rules. While at it, do not prefix pure echo lines with a 'cd $(TEST_D) &&', as that's rather silly. Reviewed-by: Andy Polyakov <appro@openssl.org>
* New ASN1_TYPE SEQUENCE functions.Dr. Stephen Henson2015-03-301-0/+2
| | | | | | | | | Add new functions ASN1_TYPE_pack_sequence and ASN1_TYPE_unpack_sequence: these encode and decode ASN.1 SEQUENCE using an ASN1_TYPE structure. Update ordinals. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove d2i_X509_PKEY and i2d_X509_PKEYDr. Stephen Henson2015-03-281-2/+2
| | | | | | | Remove partially implemented d2i_X509_PKEY and i2d_X509_PKEY: nothing uses them and they don't work properly. Update ordinals. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* update ordinalsDr. Stephen Henson2015-03-261-11/+11
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* make updateDr. Stephen Henson2015-03-251-12/+13
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* update ordinalsDr. Stephen Henson2015-03-241-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-27 03:38:32 +0000