Commit 81dde5e8 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Add support for experimental code, not compiled in by default and 

with OPENSSL_EXPERIMENTAL_FOO around it. Make JPAKE experimental.
parent b84e4418

CHANGES

+6 −0
Original line number Diff line number Diff line
@@ -4,6 +4,12 @@ 


 Changes between 0.9.8i and 0.9.8j  [xx XXX xxxx]



  *) Update Configure code and WIN32 build scripts to support experimental

     code. This is surrounded by OPENSSL_EXPERIMENTAL_FOO and not compiled

     in by default. Using the configuration option "enable-experimental-foo"

     enables it. Use this option for JPAKE.

     [Steve Henson]



  *) Use correct exit code if there is an error in dgst command.

     [Steve Henson; problem pointed out by Roland Dirlewanger]

Configure

+11 −1
Original line number Diff line number Diff line
@@ -588,6 +588,7 @@ my $no_threads=0; 
my $threads=0;

my $no_shared=0; # but "no-shared" is default

my $zlib=1;      # but "no-zlib" is default

my $jpake=1;      # but "no-jpake" is default

my $no_krb5=0;   # but "no-krb5" is implied unless "--with-krb5-..." is used

my $no_rfc3779=1; # but "no-rfc3779" is default

my $montasm=1;   # but "no-montasm" is default
@@ -628,6 +629,7 @@ my %disabled = ( # "what" => "comment" 
                 "camellia"       => "default",

                 "capieng"        => "default",

                 "cms"            => "default",

                 "experimental-jpake"          => "default",

                 "gmp"            => "default",

                 "mdc2"           => "default",

                 "montasm"        => "default", # explicit option in 0.9.8 only (implicitly enabled in 0.9.9)
@@ -975,6 +977,8 @@ foreach (sort (keys %disabled)) 
		{ $no_threads = 1; }

	elsif (/^shared$/)

		{ $no_shared = 1; }

	elsif (/^experimental-jpake$/)

		{ $jpake = 0; push @skip, "jpake"}

	elsif (/^zlib$/)

		{ $zlib = 0; }

	elsif (/^montasm$/)
@@ -1212,6 +1216,11 @@ if ($threads) 
	$openssl_thread_defines .= $thread_defines;

	}



if ($jpake)

	{

	$openssl_other_defines = "#define OPENSSL_EXPERIMENTAL_JPAKE\n";

	}



if ($zlib)

	{

	$cflags = "-DZLIB $cflags";
@@ -1410,7 +1419,8 @@ while (<IN>) 
	if ($sdirs) {

		my $dir;

		foreach $dir (@skip) {

			s/([ 	])$dir /\1/;

			s/(\s)$dir\s/$1/;

			s/\s$dir$//;

			}

		}

	$sdirs = 0 unless /\\$/;

apps/apps.c

+6 −0
Original line number Diff line number Diff line
@@ -130,7 +130,9 @@ 
#include <openssl/rsa.h>

#endif

#include <openssl/bn.h>

#ifdef OPENSSL_EXPERIMENTAL_JPAKE

#include <openssl/jpake.h>

#endif



#define NON_MAIN

#include "apps.h"
@@ -2336,6 +2338,8 @@ void policies_print(BIO *out, X509_STORE_CTX *ctx) 
		BIO_free(out);

	}



#ifdef OPENSSL_EXPERIMENTAL_JPAKE



static JPAKE_CTX *jpake_init(const char *us, const char *them,

							 const char *secret)

	{
@@ -2547,3 +2551,5 @@ void jpake_server_auth(BIO *out, BIO *conn, const char *secret) 
	BIO_pop(bconn);

	BIO_free(bconn);

	}



#endif

apps/apps.h

+2 −0
Original line number Diff line number Diff line
@@ -338,8 +338,10 @@ X509_NAME *parse_name(char *str, long chtype, int multirdn); 
int args_verify(char ***pargs, int *pargc,

			int *badarg, BIO *err, X509_VERIFY_PARAM **pm);

void policies_print(BIO *out, X509_STORE_CTX *ctx);

#ifdef OPENSSL_EXPERIMENTAL_JPAKE

void jpake_client_auth(BIO *out, BIO *conn, const char *secret);

void jpake_server_auth(BIO *out, BIO *conn, const char *secret);

#endif



#define FORMAT_UNDEF    0

#define FORMAT_ASN1     1

apps/s_client.c

+6 −1
Original line number Diff line number Diff line
@@ -338,7 +338,9 @@ int MAIN(int argc, char **argv) 
	int peerlen = sizeof(peer);

	int enable_timeouts = 0 ;

	long mtu = 0;

#ifdef OPENSSL_EXPERIMENTAL_JPAKE

	char *jpake_secret = NULL;

#endif



#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)

	meth=SSLv23_client_method();
@@ -583,11 +585,13 @@ int MAIN(int argc, char **argv) 
			/* meth=TLSv1_client_method(); */

			}

#endif

#ifdef OPENSSL_EXPERIMENTAL_JPAKE

		else if (strcmp(*argv,"-jpake") == 0)

			{

			if (--argc < 1) goto bad;

			jpake_secret = *++argv;

			}

#endif

		else

			{

			BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -893,9 +897,10 @@ SSL_set_tlsext_status_ids(con, ids); 
#endif

		}

#endif



#ifdef OPENSSL_EXPERIMENTAL_JPAKE

	if (jpake_secret)

		jpake_client_auth(bio_c_out, sbio, jpake_secret);

#endif



	SSL_set_bio(con,sbio,sbio);

	SSL_set_connect_state(con);