aboutsummaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)AuthorFilesLines
2016-02-06Add SSL_get0_verified_chain() to return verified chain of peerDr. Stephen Henson1-0/+1
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Add a BIO_ADDR_clear functionMatt Caswell1-0/+1
Adds a new function BIO_ADDR_clear to reset a BIO_ADDR back to an unitialised state, and to set the family to AF_UNSPEC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05GH601: Various spelling fixes.FdaSilvaYY4-5/+5
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-05Make DTLSv1_listen a first class function and change its typeMatt Caswell1-4/+3
The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-05Long overdue cleanup of X509 policy tree verificationViktor Dukhovni1-8/+20
Replace all magic numbers with #defined constants except in boolean functions that return 0 for failure and 1 for success. Avoid a couple memory leaks in error recovery code paths. Code style improvements. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-02-05Add EC_KEY_priv2buf()Dr. Stephen Henson1-0/+7
Add new function EC_KEY_priv2buf() to allocated and encode private key octet in one call. Update and simplify ASN.1 and print routines. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05update EC ASN1 and print routinesDr. Stephen Henson1-0/+2
Update EC ASN.1 and print routines to use EC_KEY_oct2priv and EC_KEY_priv2oct. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Add EC_KEY_oct2priv and EC_KEY_priv2octDr. Stephen Henson1-0/+20
New functions EC_KEY_oct2priv and EC_KEY_priv2oct. These are private key equivalents of EC_POINT_oct2point and EC_POINT_point2oct which convert between the private key octet format and EC_KEY. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Add ASN1_buf_print to print a buffer in ASN1_bn_print format.Dr. Stephen Henson1-0/+1
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-04Add new DTLS-SRTP protection profiles from RFC 7714Dmitry Sobinov1-0/+4
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-04Use WSAGetLastError() on windowsKurt Roeckx1-0/+1
Windows doesn't have h_error or hstrerror() Reviewed-by: Richard Levitte <levitte@openssl.org> MR: #1848
2016-02-04update OID tablesDr. Stephen Henson1-0/+16
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-03RT2752: Add some EKU OID'sRich Salz1-0/+54
And some others found in the Internet. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-03Tweak opensslconf.h.in for styleRich Salz2-75/+46
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-03make updateRichard Levitte1-0/+5
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: adapt BIO_s_connect and BIO_s_acceptRichard Levitte1-29/+33
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03make updateRichard Levitte1-0/+1
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03make updateRichard Levitte1-0/+14
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: new socket-handling functions, deprecate older onesRichard Levitte2-14/+33
Added functions: BIO_socket BIO_connect BIO_listen BIO_accept_ex BIO_closesocket BIO_sock_info These get deprecated: BIO_gethostbyname BIO_get_port BIO_get_host_ip BIO_get_accept_socket BIO_accept Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: add error macros & text, and make updateRichard Levitte2-0/+8
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: add wrappers around sockaddr et alRichard Levitte1-0/+32
Because different platforms have different levels of support for IPv6, different kinds of sockaddr variants, and some have getaddrinfo et al while others don't, we could end up with a mess if ifdefs, duplicate code and other maintainance nightmares. Instead, we're introducing wrappers around the common form for socket communication: BIO_ADDR, closely related to struct sockaddr and some of its variants. BIO_ADDRINFO, closely related to struct addrinfo. With that comes support routines, both convenient creators and accessors, plus a few utility functions: BIO_parse_hostserv, takes a string of the form host:service and splits it into host and service. It checks for * in both parts, and converts any [ipv6-address] syntax to ust the IPv6 address. BIO_lookup, looks up information on a host. All routines handle IPv4 (AF_INET) and IPv6 (AF_INET6) addresses, and there is support for local sockets (AF_UNIX) as well. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-02RT2353: Add ipsec IKE OIDRich Salz1-0/+5
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-02-02New BN functions.Dr. Stephen Henson1-0/+3
Add new function BN_bn2binpad() which checks the length of the output buffer and pads the result with zeroes if necessary. New functions BN_bn2lebinpad() and BN_lebin2bn() which use little endian format. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-01Style; add "!= NULL"Rich Salz1-1/+1
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-02-01constify PACKETEmilia Kasper2-3/+3
PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31Compat self-signed trust with reject-only aux dataViktor Dukhovni1-0/+5
When auxiliary data contains only reject entries, continue to trust self-signed objects just as when no auxiliary data is present. This makes it possible to reject specific uses without changing what's accepted (and thus overring the underlying EKU). Added new supported certs and doubled test count from 38 to 76. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31Check chain extensions also for trusted certificatesViktor Dukhovni1-1/+1
This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31Add EC_GROUP_order_bits, EC_GROUP_get0_order and EC_GROUP_get0_cofactorDr. Stephen Henson1-0/+21
New functions to return internal pointer for order and cofactor. This avoids the need to allocate a new BIGNUM which to copy the value to. Simplify code to use new functions. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31RT4129: BUF_new_mem_buf should take const void *Daniel Kahn Gillmor1-1/+1
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-30GH102: Extra volatile avoids GCC bugRich Salz1-1/+3
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-30Remove extra level of indirection.Rich Salz1-8/+6
Remove OPENSSL_IMPORT as its only purpose is to define OPENSSL_EXTERN. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30Move more BN internals to bn_lcl.hRich Salz3-109/+7
There was an unused macro in ssl_locl.h that used an internal type, so I removed it. Move bio_st from bio.h to ossl_type.h Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-30GH102: Add volatile to CRYPTO_memcmpRich Salz1-1/+1
Can't hurt and seems to prevent problems from some over-aggressive (LTO?) compilers. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30Add function to return internal enoding of X509_NAME.Dr. Stephen Henson1-0/+3
PR#4280 Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-01-29Make it possible to check for explicit auxiliary trustViktor Dukhovni1-2/+3
By default X509_check_trust() trusts self-signed certificates from the trust store that have no explicit local trust/reject oids encapsulated as a "TRUSTED CERTIFICATE" object. (See the -addtrust and -trustout options of x509(1)). This commit adds a flag that makes it possible to distinguish between that implicit trust, and explicit auxiliary settings. With flags |= X509_TRUST_NO_SS_COMPAT, a certificate is only trusted via explicit trust settings. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-29Correct value of DH_CHECK_PUBKEY_INVALIDMatt Caswell1-1/+1
A new return value for DH_check_pub_key was recently added: DH_CHECK_PUBKEY_INVALID. As this is a flag which can be ORed with other return values it should have been set to the value 4 not 3. RT#4278 Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-28Correct number of arguments in BIO_get_conn_int_port macroRichard Levitte1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-28Prevent small subgroup attacks on DH/DHEMatt Caswell1-0/+1
Historically OpenSSL only ever generated DH parameters based on "safe" primes. More recently (in version 1.0.2) support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be "safe". Where an application is using DH configured with parameters based on primes that are not "safe" then an attacker could use this fact to find a peer's private DH exponent. This attack requires that the attacker complete multiple handshakes in which the peer uses the same DH exponent. A simple mitigation is to ensure that y^q (mod p) == 1 CVE-2016-0701 Issue reported by Antonio Sanso. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-28Fix typo in md2.hRich Salz1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-01-27Add CRYPTO_secure_zallocRich Salz1-0/+5
Also turn B<foo> into foo() in the pod page. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-27Remove outdated legacy crypto optionsRich Salz5-11/+11
Many options for supporting optimizations for legacy crypto on legacy platforms have been removed. This simplifies the source code and does not really penalize anyone. DES_PTR (always on) DES_RISC1, DES_RISC2 (always off) DES_INT (always 'unsigned int') DES_UNROLL (always on) BF_PTR (always on) BF_PTR2 (removed) MD2_CHAR, MD2_LONG (always 'unsigned char') IDEA_SHORT, IDEA_LONG (always 'unsigned int') RC2_SHORT, RC2_LONG (always 'unsigned int') RC4_LONG (only int and char (for assembler) are supported) RC4_CHUNK (always long), RC_CHUNK_LL (removed) RC4_INDEX (always on) And also make D_ENCRYPT macro more clear (@appro) This is done in consultation with Andy. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-01-27Complete the removal of /* foo.c */ commentsRichard Levitte1-1/+0
Some files that are automatically generated still had those comments added by the generating scripts. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-26Remove /* foo.c */ commentsRich Salz65-65/+0
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-26Add SSL_up_ref() and SSL_CTX_up_ref()Matt Caswell1-0/+2
The SSL and SSL_CTX structures are reference counted. However since libssl was made opaque there is no way for users of the library to manipulate the reference counts. This adds functions to enable that. Reviewed-by: Stephen Henson <steve@openssl.org>
2016-01-25Generate warning textRichard Levitte1-1/+1
Now that we're using templates, we should warn people not to edit the resulting file. We do it through util/dofile.pl, which is enhanced with an option to tell what file it was called from. We also change the calls so the template files are on the command line instead of being redirected through standard input. That way, we can display something like this (example taken from include/openssl/opensslconf.h): /* WARNING: do not edit! */ /* Generated by Configure from include/openssl/opensslconf.h.in */ Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-25Move & split opensslconf.h.inRich Salz1-0/+173
Move opensslconf.h.in to include/openssl. Split off DES,BN,RC4 stuff into separate header file templates in crypto/include/internal/*_conf.h.in Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-24Move pqueue into sslRich Salz1-99/+0
This is an internal facility, never documented, not for public consumption. Move it into ssl (where it's only used for DTLS). I also made the typedef's for pqueue and pitem follow our style: they name structures, not pointers. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-22Updated OSSL_DYNAMIC_VERSION/OSSL_DYNAMIC_OLDESTMichał Trojnara1-2/+2
Change to reflect changes in dynamic_fns Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-20Handle SSL_shutdown while in init more appropriatelyMatt Caswell1-0/+2
Calling SSL_shutdown while in init previously gave a "1" response, meaning everything was successfully closed down (even though it wasn't). Better is to send our close_notify, but fail when trying to receive one. The problem with doing a shutdown while in the middle of a handshake is that once our close_notify is sent we shouldn't really do anything else (including process handshake/CCS messages) until we've received a close_notify back from the peer. However the peer might send a CCS before acting on our close_notify - so we won't be able to read it because we're not acting on CCS messages! Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-20make EVP_PKEY opaqueDr. Stephen Henson1-30/+1
Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.1 at 2024-07-13 19:18:25 +0000