aboutsummaryrefslogtreecommitdiff
path: root/ssl/ssl_ciph.c
AgeCommit message (Collapse)AuthorFilesLines
2015-11-09Standardise our style for checking malloc failuresMatt Caswell1-1/+1
if we have a malloc |x = OPENSSL_malloc(...)| sometimes we check |x| for NULL and sometimes we treat it as a boolean |if(!x) ...|. Standardise the approach in libssl. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-11-08Use uint32_t and int32_t for SSL_CIPHER structure.Dr. Stephen Henson1-45/+42
Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-09-30Change the DEFAULT ciphersuites to exclude DES, RC4 and RC2Matt Caswell1-2/+18
This patch updates the "DEFAULT" cipherstring to be "ALL:!COMPLEMENTOFDEFAULT:!eNULL". COMPLEMENTOFDEFAULT is now defined internally by a flag on each ciphersuite indicating whether it should be excluded from DEFAULT or not. This gives us control at an individual ciphersuite level as to exactly what is in DEFAULT and what is not. Finally all DES, RC4 and RC2 ciphersuites are added to COMPLEMENTOFDEFAULT and hence removed from DEFAULT. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-04Match SUITEB strings at start of cipher list.Dr. Stephen Henson1-5/+6
PR#4009. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-09-02Add and use OPENSSL_zallocRich Salz1-2/+1
There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-08-14ccm8 supportDr. Stephen Henson1-5/+17
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-08-14CCM support.Dr. Stephen Henson1-6/+18
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-08-11Remove Gost94 signature algorithm.Rich Salz1-10/+2
This was obsolete in 2001. This is not the same as Gost94 digest. Thanks to Dmitry Belyavsky <beldmit@gmail.com> for review and advice. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-07-30Disable unsupported PSK algorithmsDr. Stephen Henson1-4/+4
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-07-30new PSK text constantsDr. Stephen Henson1-0/+9
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-07-30New PSK aliases.Dr. Stephen Henson1-1/+4
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-06-10Tidy disabled algorithm handling.Dr. Stephen Henson1-96/+73
Determine disabled algorithm masks when algorithms are loaded instead of recalculating them each time. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-06-10Restore GOST mac setup.Dr. Stephen Henson1-0/+4
Restore GOST mac setup which was accidentally removed during cipher refactor. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-13Remove Kerberos support from libsslMatt Caswell1-37/+2
Remove RFC2712 Kerberos support from libssl. This code and the associated standard is no longer considered fit-for-purpose. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-12Make COMP_CTX and COMP_METHOD opaqueRich Salz1-21/+25
Since COMP_METHOD is now defined in comp_lcl.h, it is no longer possible to create new TLS compression methods without using the OpenSSL source. Only ZLIB is supported by default. Also, since the types are opaque, #ifdef guards to use "char *" instead of the real type aren't necessary. The changes are actually minor. Adding missing copyright to some files makes the diff misleadingly big. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-05-06Use "==0" instead of "!strcmp" etcRich Salz1-8/+8
For the various string-compare routines (strcmp, strcasecmp, str.*cmp) use "strcmp()==0" instead of "!strcmp()" Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-05memset, memcpy, sizeof consistency fixesRich Salz1-2/+2
Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-04Use safer sizeof variant in mallocRich Salz1-4/+4
For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-03Add OSSL_NELEM macro.Dr. Stephen Henson1-2/+2
Add OSSL_NELEM macro to e_os.h to determine the number of elements in an array. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-01free NULL cleanup -- codaRich Salz1-2/+1
After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-01free null cleanup finaleRich Salz1-1/+1
Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-28remove malloc castsRich Salz1-4/+3
Following ANSI C rules, remove the casts from calls to OPENSSL_malloc and OPENSSL_realloc. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-22SSL_CIPHER lookup functions.Dr. Stephen Henson1-125/+95
Add tables to convert between SSL_CIPHER fields and indices for ciphers and MACs. Reorganise ssl_ciph.c to use tables to lookup values and load them. New functions SSL_CIPHER_get_cipher_nid and SSL_CIPHER_get_digest_nid. Add documentation. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-04-16Code style: space after 'if'Viktor Dukhovni1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-23Fix missing return value checksMatt Caswell1-1/+4
Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-11Merge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_ECRich Salz1-6/+3
Suggested by John Foley <foleyj@cisco.com>. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-01-22Re-align some comments after running the reformat script.Matt Caswell1-8/+8
This should be a one off operation (subsequent invokation of the script should not move them) Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell1-1787/+1794
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22More tweaks for comments due indent issuesmaster-pre-auto-reformatMatt Caswell1-1/+2
Conflicts: ssl/ssl_ciph.c ssl/ssl_locl.h Conflicts: ssl/s2_srvr.c ssl/ssl.h Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-30mark all block comments that need format preserving so thatTim Hudson1-6/+8
indent will not alter them when reformatting comments Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-17Clear warnings/errors within KSSL_DEBUG code sectionsRichard Levitte1-2/+2
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-17Clear warnings/errors within CIPHER_DEBUG code sectionsRichard Levitte1-4/+4
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-16Add more meaningful OPENSSL_NO_ECDH error message for suite b modeMatt Caswell1-1/+1
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-12-16Add OPENSSL_NO_ECDH guardsMatt Caswell1-0/+5
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-12-10SSL_COMP_add_compression_method: exit if allocating the new compression ↵Jonas Maebe1-0/+7
method struct fails Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-12-08Remove some unnecessary OPENSSL_FIPS referencesDr. Stephen Henson1-8/+0
FIPS_mode() exists in all versions of OpenSSL but always returns 0 if OpenSSL is not FIPS capable. Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-04ssl_create_cipher_list: check whether push onto cipherstack succeedsJonas Maebe1-1/+6
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Richard Levitte <levitte@openssl.org>
2014-12-04Remove SSLv2 supportKurt Roeckx1-12/+4
The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: Richard Levitte <levitte@openssl.org>
2014-08-18RT1815: More const'ness improvementsJustin Blanchard1-1/+1
Add a dozen more const declarations where appropriate. These are from Justin; while adding his patch, I noticed ASN1_BIT_STRING_check could be fixed, too. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2014-07-14Use more common name for GOST key exchange.Dr. Stephen Henson1-1/+1
2014-07-13Add names of GOST algorithms.Peter Mosmans1-0/+18
PR#3440
2014-07-02Make disabling last cipher work.Thijs Alkemade1-7/+11
2014-06-22Fix off-by-one errors in ssl_cipher_get_evp()Miod Vallat1-2/+2
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays. Bug discovered and fixed by Miod Vallat from the OpenBSD team. PR#3375
2014-06-22Revert "Fix off-by-one errors in ssl_cipher_get_evp()"Matt Caswell1-2/+2
This reverts commit abfb989fe0b749ad61f1aa4cdb0ea4f952fc13e0. Incorrect attribution
2014-06-12Fix off-by-one errors in ssl_cipher_get_evp()Kurt Cancemi1-2/+2
In the ssl_cipher_get_evp() function, fix off-by-one errors in index validation before accessing arrays. PR#3375
2014-06-09SRP ciphersuite correction.Dr. Stephen Henson1-0/+4
SRP ciphersuites do not have no authentication. They have authentication based on SRP. Add new SRP authentication flag and cipher string.
2014-03-28Set security level in cipher string.Dr. Stephen Henson1-6/+21
Allow setting of security level in cipher string using the @SECLEVEL=N syntax.
2014-03-01Add function to free compression methods.Dr. Stephen Henson1-0/+12
Although the memory allocated by compression methods is fixed and cannot grow over time it can cause warnings in some leak checking tools. The function SSL_COMP_free_compression_methods() will free and zero the list of supported compression methods. This should *only* be called in a single threaded context when an application is shutting down to avoid interfering with existing contexts attempting to look up compression methods. (cherry picked from commit 976c58302b13d085edb3ab822f5eac4b2f1bff95)
2014-02-06Return previous compression methods when setting them.Dr. Stephen Henson1-1/+3
2014-01-27New function to set compression methods so they can be safely freed.Dr. Stephen Henson1-0/+5
generated by cgit v1.1 at 2024-08-11 11:28:30 +0000