aboutsummaryrefslogtreecommitdiff
path: root/ssl/ssl_ciph.c
AgeCommit message (Collapse)AuthorFilesLines
2019-01-15Add missing entries in ssl_mac_pkey_idMatt Caswell1-0/+2
Fixes #8005 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/8020)
2018-12-06Following the license change, modify the boilerplates in ssl/Richard Levitte1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7768)
2018-09-18ssl/ssl_ciph.c: make set_ciphersuites staticDr. Matthias St. Pierre1-1/+1
Fixes #7252 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7253)
2018-08-07Harmonize use of sk_TYPE_find's return value.Andy Polyakov1-4/+1
In some cases it's about redundant check for return value, in some cases it's about replacing check for -1 with comparison to 0. Otherwise compiler might generate redundant check for <-1. [Even formatting and readability fixes.] Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6860)
2018-04-04Fix configuration of TLSv1.3 ciphersuitesMatt Caswell1-8/+128
Configuration of TLSv1.3 ciphersuites wasn't working in some cases. Fixes #5740 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5855)
2018-04-03Set error code on alloc failuresRich Salz1-2/+3
Almost all *alloc failures now set an error code. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5842)
2018-03-14Split configuration of TLSv1.3 ciphers from older ciphersMatt Caswell1-5/+16
With the current mechanism, old cipher strings that used to work in 1.1.0, may inadvertently disable all TLSv1.3 ciphersuites causing connections to fail. This is confusing for users. In reality TLSv1.3 are quite different to older ciphers. They are much simpler and there are only a small number of them so, arguably, they don't need the same level of control that the older ciphers have. This change splits the configuration of TLSv1.3 ciphers from older ones. By default the TLSv1.3 ciphers are on, so you cannot inadvertently disable them through your existing config. Fixes #5359 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5392)
2018-01-19Copyright update of more files that have changed this yearRichard Levitte1-1/+1
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/5110)
2018-01-06Stop using unimplemented cipher classes.Bernd Edlinger1-4/+0
Add comments to no longer usable ciphers. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5023)
2017-12-27Alternate fix for ../test/recipes/80-test_ssl_old.t with no-ecBernd Edlinger1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4981)
2017-10-18Remove parentheses of return.KaoruToda1-1/+1
Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-08-31Add ARIA as an alias for all ARIA based modes.Pauli1-0/+1
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4300)
2017-08-30Introduce SSL_CIPHER_get_protocol_idPaul Yang1-0/+5
The returned ID matches with what IANA specifies (or goes on the wire anyway, IANA notwithstanding). Doc is added. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4107)
2017-08-30Implement Aria GCM/CCM Modes and TLS cipher suitesJon Spillett1-4/+18
AEAD cipher mode implementation is based on that used for AES: https://tools.ietf.org/html/rfc5116 TLS GCM cipher suites as specified in: https://tools.ietf.org/html/rfc6209 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4287)
2017-08-30e_os.h removal from other headers and source files.Pauli1-0/+1
Removed e_os.h from all bar three headers (apps/apps.h crypto/bio/bio_lcl.h and ssl/ssl_locl.h). Added e_os.h into the files that need it now. Directly reference internal/nelem.h when required. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
2017-08-22Fix ctype arguments.Pauli1-1/+2
Cast arguments to the various ctype functions to unsigned char to match their documentation. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4203)
2017-08-03Move ossl_assertMatt Caswell1-0/+1
Move the definition of ossl_assert() out of e_os.h which is intended for OS specific things. Instead it is moved into internal/cryptlib.h. This also changes the definition to remove the (int) cast. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4073)
2017-07-30Fix typos in files in ssl directoryXiaoyin Liu1-1/+1
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4052)
2017-07-21Support converting cipher name to RFC name and vice versaPaul Yang1-118/+145
Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
2017-07-13Use certificate tables instead of ssl_cipher_get_cert_index.Dr. Stephen Henson1-21/+0
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Add certificate properties table.Dr. Stephen Henson1-0/+9
Add certificate table giving properties of each certificate index: specifically the NID associated with the index and the the auth mask value for any cipher the certificate can be used with. This will be used to generalise certificate handling instead of hard coding algorithm specific cases. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-06-21PSK related tweaks based on review feedbackMatt Caswell1-2/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
2017-06-21Add a function to get the handshake digest for an SSL_CIPHERMatt Caswell1-0/+10
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
2017-06-21Merge Nokia copyright notice into standardRich Salz1-27/+1
This is done with the kind permission of Nokia. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3722)
2017-06-20Modify Sun copyright to follow OpenSSL styleRich Salz1-5/+1
Approved by Oracle. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3585)
2017-05-22Replace instances of OPENSSL_assert() with soft asserts in libsslMatt Caswell1-4/+9
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3496)
2017-03-01Remove some obsolete/obscure internal define switches:Emilia Kasper1-3/+0
- FLAT_INC - PKCS1_CHECK (the SSL_OP_PKCS1_CHECK options have been no-oped) - PKCS_TESTVECT (debugging leftovers) - SSL_AD_MISSING_SRP_USERNAME (unfinished feature) - DTLS_AD_MISSING_HANDSHAKE_MESSAGE (unfinished feature) - USE_OBJ_MAC (note this removes a define from the public header but very unlikely someone would be depending on it) - SSL_FORBID_ENULL Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org>
2017-02-28Remove some commented out code in libsslMatt Caswell1-3/+0
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2774)
2017-02-28Clean up references to FIPSEmilia Kasper1-7/+1
This removes the fips configure option. This option is broken as the required FIPS code is not available. FIPS_mode() and FIPS_mode_set() are retained for compatibility, but FIPS_mode() always returns 0, and FIPS_mode_set() can only be used to turn FIPS mode off. Reviewed-by: Stephen Henson <steve@openssl.org>
2017-02-23Let ssl_get_cipher_by_char yield not-valid ciphersBenjamin Kaduk1-2/+3
Now that we have made SCSVs into more of a first-class object, provide a way for the bytes-to-SSL_CIPHER conversion to actually return them. Add a flag 'all' to ssl_get_cipher_by_char to indicate that we want all the known ciphers, not just the ones valid for encryption. This will, in practice, let the caller retrieve the SCSVs. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2279)
2017-02-21Implementation of the ARIA cipher as described in RFC 5794.Pauli1-4/+1
This implementation is written in endian agnostic C code. No attempt at providing machine specific assembly code has been made. This implementation expands the evptests by including the test cases from RFC 5794 and ARIA official site rather than providing an individual test case. Support for ARIA has been integrated into the command line applications, but not TLS. Implemented modes are CBC, CFB1, CFB8, CFB128, CTR, ECB and OFB128. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2337)
2017-02-14mem leak on error path and error propagation fixYuchi1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2559)
2017-02-10Replace SSL_PKEY_RSA_ENC, SSL_PKEY_RSA_SIGNDr. Stephen Henson1-1/+1
The original intent of SSL_PKEY_RSA_SIGN and SSL_PKEY_RSA_ENC was to support two different keys for RSA signing and decrypt. However this was never implemented and we only ever set one key and the other was always NULL. Replace with single SSL_PKEY_RSA type. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2587)
2017-02-08Add NID_auth_any and NID_kx_any NIDs.Dr. Stephen Henson1-2/+4
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2550)
2017-02-08Add SSL_kANY and SSL_aANYDr. Stephen Henson1-0/+6
Add SSL_kANY and SSL_aANY contants for TLS 1.3 ciphersuites. Return appropriate text strings when they are used. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2550)
2017-01-30Always ensure that session->cipher is setMatt Caswell1-11/+0
If we have deserialized the SSL_SESSION then in some circumstances the session->cipher value is NULL. We were patching up in some places but not in others. We should just do it as part of loading the SSL_SESSION. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-30Implement Server side of PSK extension parsingMatt Caswell1-0/+11
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2259)
2017-01-25Fix a few misspellings.FdaSilvaYY1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1618)
2016-11-16Remove a hack from ssl_test_oldMatt Caswell1-0/+18
ssl_test_old was reaching inside the SSL structure and changing the internal BIO values. This is completely unneccessary, and was causing an abort in the test when enabling TLSv1.3. I also removed the need for ssl_test_old to include ssl_locl.h. This required the addition of some missing accessors for SSL_COMP name and id fields. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Fix misc size_t issues causing Windows warnings in 64 bitMatt Caswell1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-04Convert master_secret_size code to size_tMatt Caswell1-4/+5
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02Add DTLS_get_data_mtu() functionDavid Woodhouse1-0/+52
We add ssl_cipher_get_overhead() as an internal function, to avoid having too much ciphersuite-specific knowledge in DTLS_get_data_mtu() itself. It's going to need adjustment for TLSv1.3... but then again, so is fairly much *all* of the SSL_CIPHER handling. This bit is in the noise. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-11-02Use ciphersuite id when matching if we've got oneMatt Caswell1-0/+2
When matching a ciphersuite if we are given an id, make sure we use it otherwise we will match another ciphersuite which is identical except for the TLS version. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-26Remove trailing zerosRich Salz1-87/+73
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-18Indent ssl/Emilia Kasper1-52/+52
Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-06Fix CIPHER_DEBUGJimC1-1/+1
Commit 3eb2aff renamed a field of ssl_cipher_st from algorithm_ssl -> min_tls but neglected to update the fprintf reference which is included by -DCIPHER_DEBUG Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1417)
2016-07-22Have load_buildtin_compression in ssl/ssl_ciph.c return RUN_ONCE resultRichard Levitte1-3/+8
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-19Change all our uses of CRYPTO_THREAD_run_once to use RUN_ONCE insteadRichard Levitte1-3/+4
That way, we have a way to check if the init function was successful or not. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-06-23Add checks on sk_TYPE_push() returned resultFdaSilvaYY1-2/+2
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-17Copyright consolidation 01/10Rich Salz1-107/+7
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
generated by cgit v1.1 at 2024-07-13 10:48:47 +0000