- Feb 07, 2018
-
-
Matt Caswell authored
[extended tests] Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5266)
-
- Jan 29, 2018
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5185)
-
- Jan 28, 2018
-
-
Richard Levitte authored
Reviewed-by:
Tim Hudson <tjh@openssl.org> Reviewed-by:
-
- Jan 23, 2018
-
-
Pauli authored
Support added for these two digests, available only via the EVP interface. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5093)
-
- Jan 07, 2018
-
-
Richard Levitte authored
Reviewed-by:
-
Rich Salz authored
Reviewed-by:
-
- Jan 02, 2018
-
-
Daniel Bevenius authored
Similar to commit 17b60280 ( "Remove extra `the` in SSL_SESSION_set1_id.pod"), this commit removes typos where additional 'the' have been added. Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
-
- Dec 12, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Dec 07, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Dec 06, 2017
-
-
Matt Caswell authored
Reviewed-by:
-
- Nov 21, 2017
-
-
Paul Yang authored
* Introduce RSA_generate_multi_prime_key to generate multi-prime RSA private key. As well as the following functions: RSA_get_multi_prime_extra_count RSA_get0_multi_prime_factors RSA_get0_multi_prime_crt_params RSA_set0_multi_prime_params RSA_get_version * Support EVP operations for multi-prime RSA * Support ASN.1 operations for multi-prime RSA * Support multi-prime check in RSA_check_key_ex * Support multi-prime RSA in apps/genrsa and apps/speed * Support multi-prime RSA manipulation functions * Test cases and documentation are added * CHANGES is updated Reviewed-by:Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4241)
-
- Nov 12, 2017
-
-
Josh Soref authored
Around 138 distinct errors found and fixed; thanks! Reviewed-by:
Kurt Roeckx <kurt@roeckx.be> Reviewed-by:
-
- Nov 05, 2017
-
-
Jack Lloyd authored
SM3 is a secure hash function which is part of the Chinese "Commercial Cryptography" suite of algorithms which use is required for certain commercial applications in China. Reviewed-by:
Paul Dale <paul.dale@oracle.com> Reviewed-by:
-
FdaSilvaYY authored
Based on patch from Tomasz Moń: https://groups.google.com/forum/#!topic/mailing.openssl.dev/fQxXvCg1uQY Reviewed-by:
-
- Nov 02, 2017
-
-
Matt Caswell authored
Reviewed-by:
-
- Oct 31, 2017
-
-
Ronald Tse authored
Reviewed-by:
-
- Oct 25, 2017
-
-
Ronald Tse authored
Reviewed-by:
-
- Oct 07, 2017
-
-
Rich Salz authored
Rewrite the -req-nodes flag from CA.pl (idea from Andy) Rewrite ERR_string_error_n Reviewed-by:
-
- Aug 30, 2017
-
-
Jon Spillett authored
AEAD cipher mode implementation is based on that used for AES: https://tools.ietf.org/html/rfc5116 TLS GCM cipher suites as specified in: https://tools.ietf.org/html/rfc6209 Reviewed-by:
-
- Aug 27, 2017
-
-
Rich Salz authored
VisualStudio 6 and earlier aren't supported. Reviewed-by:
-
- Aug 15, 2017
-
-
Richard Levitte authored
This allows callers to set a mark, and then clear it without removing the errors. Useful in case an error is encountered that should be returned up the call stack. Reviewed-by:
-
- Aug 07, 2017
-
-
Rich Salz authored
Use atfork to count child forks, and reseed DRBG when the counts don't match. Reviewed-by:
-
- Jul 25, 2017
-
-
Andy Polyakov authored
Reviewed-by:
-
- Jul 03, 2017
-
-
Richard Levitte authored
Instead, make it possible to disable the console reader that's part of the UI module. This makes it possible to use the UI API and other UI methods in environments where the console reader isn't useful. To disable the console reader, configure with 'no-ui-console' / 'disable-ui-console'. 'no-ui' / 'disable-ui' is now an alias for 'no-ui-console' / 'disable-ui-console'. Fixes #3806 Reviewed-by:
-
- Jun 29, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Jun 28, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Jun 27, 2017
-
-
Richard Levitte authored
To make sure that our symbols don't clash with other libraries, we claim the namespaces OSSL and OPENSSL. Because C doesn't provide namespaces, the only solution is to have them as prefixes on symbols, thus we allow OSSL_ and OPENSSL_ as prefixes. These namespace prefixes are optional for the foreseeable future, and will only be used for new modules as needed on a case by case basis, until further notice. For extra safety, there's an added requirement that module names - apart from the namespace prefix - be at least 2 characters long. Reviewed-by:
-
- Jun 19, 2017
-
-
Rich Salz authored
Reviewed-by:
-
- Jun 16, 2017
-
-
Richard Levitte authored
This new target is used to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything to that system and do the rest of the build there. Reviewed-by:
-
- Jun 08, 2017
-
-
Tomas Mraz authored
Fixes #3490 Reviewed-by:
-
- Jun 02, 2017
-
-
Rich Salz authored
Reviewed-by:
-
- May 31, 2017
-
-
Richard Levitte authored
This can be used by engines that need to retain the data for a longer time than just the call where this user data is passed. Reviewed-by:
-
- May 25, 2017
-
-
Matt Caswell authored
Reviewed-by:
Kurt Roeckx <kurt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3546)
-
- May 17, 2017
-
-
Matt Caswell authored
An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. The DTLS code for this never worked anyway and it is not supported at a protocol level for DTLS. Similarly fragmented DTLS handshake records only work at a protocol level where at least the handshake message header exists within the record. DTLS code existed for trying to handle fragmented handshake records smaller than this size. This code didn't work either so has also been removed. Reviewed-by:
-
- Apr 27, 2017
-
-
Matt Caswell authored
Enforcement of an SNI extension in the initial ClientHello is becoming increasingly common (e.g. see GitHub issue #2580). This commit changes s_client so that it adds SNI be default, unless explicitly told not to via the new "-noservername" option. Reviewed-by:
-
- Apr 20, 2017
-
-
Rich Salz authored
X509_STORE_add_cert and X509_STORE_add_crl are changed to return success if the object to be added was already found in the store, rather than returning an error. Raise errors if empty or malformed files are read when loading certificates and CRLs. Remove NULL checks and allow a segv to occur. Add error handing for all calls to X509_STORE_add_c{ert|tl} Refactor these two routines into one. Bring the unit test for duplicate certificates up to date using the test framework. Reviewed-by:
-
- Apr 10, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
- Apr 07, 2017
-
-
Rich Salz authored
Document thread-safety issues Have RSA_null return NULL (always fails) Reviewed-by:
-
- Mar 30, 2017
-
-
Andy Polyakov authored
'j' is specified as modifier for "greatest-width integer type", which in practice means 64 bits on both 32- and 64-bit platforms. Since we rely on __attribute__((__format__(__printf__,...))) to sanitize BIO_print format, we can use it to denote [u]int64_t-s in platform-neutral manner. Reviewed-by:
-
- Mar 29, 2017
-
-
Richard Levitte authored
Reviewed-by:
-
