- 07 Jan, 2016 1 commit
-
-
Rich Salz authored
Only two macros CRYPTO_MDEBUG and CRYPTO_MDEBUG_ABORT to control this. If CRYPTO_MDEBUG is not set, #ifdef out the whole debug machinery. (Thanks to Jakob Bohm for the suggestion!) Make the "change wrapper functions" be the only paradigm. Wrote documentation! Format the 'set func' functions so their paramlists are legible. Format some multi-line comments. Remove ability to get/set the "memory debug" functions at runtme. Remove MemCheck_* and CRYPTO_malloc_debug_init macros. Add CRYPTO_mem_debug(int flag) function. Add test/memleaktest. Rename CRYPTO_malloc_init to OPENSSL_malloc_init; remove needless calls. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 02 Jan, 2016 2 commits
-
-
Viktor Dukhovni authored
The protocol selection code is now consolidated in a few consecutive short functions in a single file and is table driven. Protocol-specific constraints that influence negotiation are moved into the flags field of the method structure. The same protocol version constraints are now applied in all code paths. It is now much easier to add new protocol versions without reworking the protocol selection logic. In the presence of "holes" in the list of enabled client protocols we no longer select client protocols below the hole based on a subset of the constraints and then fail shortly after when it is found that these don't meet the remaining constraints (suiteb, FIPS, security level, ...). Ideally, with the new min/max controls users will be less likely to create "holes" in the first place. Reviewed-by:
Kurt Roeckx <kurt@openssl.org>
-
Kurt Roeckx authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
- 15 Dec, 2015 2 commits
-
-
Rich Salz authored
Reviewed-by:
Ben Laurie <ben@openssl.org>
-
Matt Caswell authored
s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by:
Kurt Roeckx <kurt@openssl.org>
-
- 13 Dec, 2015 1 commit
-
-
Rich Salz authored
(Documentation update was in the MR but not the commit. Oops.) Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
- 11 Dec, 2015 1 commit
-
-
Matt Caswell authored
The link to the OCB patent pdf changed, so the link in CHANGES needs to be updated. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 10 Dec, 2015 1 commit
-
-
Matt Caswell authored
Misc updates to the CHANGES and NEWS files ready for the alpha release. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 09 Dec, 2015 1 commit
-
-
Dr. Stephen Henson authored
Todo: update documentation. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 07 Dec, 2015 2 commits
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by:
Matt Caswell <matt@openssl.org>
-
- 05 Dec, 2015 1 commit
-
-
Kurt Roeckx authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> MR: #364
-
- 04 Dec, 2015 3 commits
-
-
Kurt Roeckx authored
Reviewed-by:
Dr. Stephen Henson <steve@openssl.org>
-
Kurt Roeckx authored
SSL_{CTX}_set_tmp_ecdh() allows to set 1 EC curve and then tries to use it. On the other hand SSL_{CTX_}set1_curves() allows you to set a list of curves, but only when SSL_{CTX_}set_ecdh_auto() was called to turn it on. Reviewed-by:
Dr. Stephen Henson <steve@openssl.org>
-
Kurt Roeckx authored
This only gets used to set a specific curve without actually checking that the peer supports it or not and can therefor result in handshake failures that can be avoided by selecting a different cipher. Reviewed-by:
Dr. Stephen Henson <steve@openssl.org>
-
- 01 Dec, 2015 1 commit
-
-
Rich Salz authored
Add CRYPTO_free_ex_index (for shared libraries) Unify and complete the documentation for all "ex_data" API's and objects. Replace xxx_get_ex_new_index functions with a macro. Added an exdata test. Renamed the ex_data internal datatypes. Reviewed-by:
Matt Caswell <matt@openssl.org>
-
- 20 Nov, 2015 2 commits
-
-
Matt Caswell authored
Add some clarifications to the async documentation. Also changed ASYNC_pause_job() so that it returns success if you are not within the context of a job. This is so that engines can be used either asynchronously or synchronously and can treat an error from ASYNC_pause_job() as a real error. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Add a CHANGES entry for the new async code. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 17 Nov, 2015 1 commit
-
-
Rich Salz authored
Final part of flushing out SSLEay API's. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
- 30 Oct, 2015 5 commits
-
-
Rich Salz authored
All instances of SSLeay (any combination of case) were replaced with the case-equivalent OpenSSL. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Remove all the defines for the old state machines states. Mapping old to new is probably going to cause more problems than it solves so it is probably better to just remove them. Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
SSL_state has been replaced by SSL_get_state and SSL_set_state is no longer supported. Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Rename the enum HANDSHAKE_STATE to OSSL_HANDSHAKE_STATE to ensure there are no namespace clashes, and convert it into a typedef. Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Update the CHANGES file for the state machine rewrite Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 26 Oct, 2015 1 commit
-
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 15 Oct, 2015 2 commits
-
-
Matt Caswell authored
There are a number of engines in the OpenSSL source code which are now obsolete. The following engines have been removed: 4758cca, aep, atalla, cswift, nuron, sureware. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 14 Oct, 2015 1 commit
-
-
Emilia Kasper authored
Thanks to the OpenBSD community for bringing this to our attention. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 30 Sep, 2015 2 commits
-
-
Matt Caswell authored
This patch updates the "DEFAULT" cipherstring to be "ALL:!COMPLEMENTOFDEFAULT:!eNULL". COMPLEMENTOFDEFAULT is now defined internally by a flag on each ciphersuite indicating whether it should be excluded from DEFAULT or not. This gives us control at an individual ciphersuite level as to exactly what is in DEFAULT and what is not. Finally all DES, RC4 and RC2 ciphersuites are added to COMPLEMENTOFDEFAULT and hence removed from DEFAULT. Reviewed-by:
Tim Hudson <tjh@openssl.org>
-
David Woodhouse authored
Much related/similar work also done by Ivan Nestlerode <ivan.nestlerode@sonos.com> +Replace FILE BIO's with dummy ops that fail. +Include <stdio.h> for sscanf() even with no-stdio (since the declaration is there). We rely on sscanf() to parse the OPENSSL_ia32cap environment variable, since it can be larger than a 'long'. And we don't rely on the availability of strtoull(). +Remove OPENSSL_stderr(); not used. +Make OPENSSL_showfatal() do nothing (currently without stdio there's nothing we can do). +Remove file-based functionality from ssl/. The function prototypes were already gone, but not the functions themselves. +Remove unviable conf functionality via SYS_UEFI +Add fallback definition of BUFSIZ. +Remove functions taking FILE * from header files. +Add missing DECLARE_PEM_write_fp_const +Disable X509_LOOKUP_hash_dir(). X509_LOOKUP_file() was already compiled out, so remove its prototype. +Use OPENSSL_showfatal() in CRYPTO_destro...
-
- 17 Sep, 2015 1 commit
-
-
Emilia Kasper authored
Rewrite EVP_DecodeUpdate. In particular: reject extra trailing padding, and padding in the middle of the content. Don't limit line length. Add tests. Previously, the behaviour was ill-defined, and depended on the position of the padding within the input. In addition, this appears to fix a possible two-byte oob read. Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Dr Stephen Henson <steve@openssl.org>
-
- 07 Sep, 2015 1 commit
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 28 Aug, 2015 1 commit
-
-
Ismo Puustinen authored
If the seed value for dsa key generation is too short (< qsize), return an error. Also update the documentation. Signed-off-by:
Rich Salz <rsalz@akamai.com> Reviewed-by:
Emilia Käsper <emilia@openssl.org>
-
- 24 Aug, 2015 1 commit
-
-
janpopan authored
Signed-off-by:
Rich Salz <rsalz@akamai.com> Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 31 Jul, 2015 1 commit
-
-
Rich Salz authored
Thanks folks: 348 Benjamin Kaduk 317 Christian Brueffer 254 Erik Tews 253 Erik Tews 219 Carl Mehner 155 (ghost) 95 mancha 51 DominikNeubauer Reviewed-by:
Dr. Stephen Henson <steve@openssl.org>
-
- 30 Jul, 2015 1 commit
-
-
Dr. Stephen Henson authored
Reviewed-by:
Matt Caswell <matt@openssl.org>
-
- 27 Jul, 2015 1 commit
-
-
Matt Caswell authored
This flag was not set anywhere within the codebase (only read). It could only be set by an app reaching directly into s->s3->flags and setting it directly. However that method became impossible when libssl was opaquified. Even in 1.0.2/1.0.1 if an app set the flag directly it is only relevant to ssl3_connect(), which calls SSL_clear() during initialisation that clears any flag settings. Therefore it could take effect if the app set the flag after the handshake has started but before it completed. It seems quite unlikely that any apps really do this (especially as it is completely undocumented). The purpose of the flag is suppress flushing of the write bio on the client side at the end of the handshake after the client has written the Finished message whilst resuming a session. This enables the client to send application data as part of the same flight as the Finished message. This flag also controls the setting of a second flag SSL3_FLAGS_POP_BUFFER. There is an interesting comment in the code about this second flag in the implementation of ssl3_write: /* This is an experimental flag that sends the * last handshake message in the same packet as the first * use data - used to see if it helps the TCP protocol during * session-id reuse */ It seems the experiment did not work because as far as I can tell nothing is using this code. The above comment has been in the code since SSLeay. This commit removes support for SSL3_FLAGS_DELAY_CLIENT_FINISHED, as well as the associated SSL3_FLAGS_POP_BUFFER. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 13 Jul, 2015 1 commit
-
-
Richard Levitte authored
This leaves behind files with names ending with '.iso-8859-1'. These should be safe to remove. If something went wrong when re-encoding, there will be some files with names ending with '.utf8' left behind. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 09 Jul, 2015 1 commit
-
-
Matt Caswell authored
Reviewed-by:
Stephen Henson <steve@openssl.org>
-
- 07 Jul, 2015 1 commit
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-