aboutsummaryrefslogtreecommitdiff
path: root/ssl/ssl_rsa.c
AgeCommit message (Collapse)AuthorFilesLines
2015-11-20Ensure all EVP calls have their returns checked where appropriateMatt Caswell1-2/+21
There are lots of calls to EVP functions from within libssl There were various places where we should probably check the return value but don't. This adds these checks. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-11-10Fix SSL_use_certificate_chain_fileMatt Caswell1-6/+15
The new function SSL_use_certificate_chain_file was always crashing in the internal function use_certificate_chain_file because it would pass a NULL value for SSL_CTX *, but use_certificate_chain_file would unconditionally try to dereference it. Reviewed-by: Stephen Henson <steve@openssl.org>
2015-10-02Remove BIO_s_file_internal macro.Rich Salz1-8/+8
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-29Fix no-stdio buildDavid Woodhouse1-2/+0
Much related/similar work also done by Ivan Nestlerode <ivan.nestlerode@sonos.com> +Replace FILE BIO's with dummy ops that fail. +Include <stdio.h> for sscanf() even with no-stdio (since the declaration is there). We rely on sscanf() to parse the OPENSSL_ia32cap environment variable, since it can be larger than a 'long'. And we don't rely on the availability of strtoull(). +Remove OPENSSL_stderr(); not used. +Make OPENSSL_showfatal() do nothing (currently without stdio there's nothing we can do). +Remove file-based functionality from ssl/. The function prototypes were already gone, but not the functions themselves. +Remove unviable conf functionality via SYS_UEFI +Add fallback definition of BUFSIZ. +Remove functions taking FILE * from header files. +Add missing DECLARE_PEM_write_fp_const +Disable X509_LOOKUP_hash_dir(). X509_LOOKUP_file() was already compiled out, so remove its prototype. +Use OPENSSL_showfatal() in CRYPTO_destroy_dynlockid(). +Eliminate SRP_VBASE_init() and supporting functions. Users will need to build the verifier manually instead. +Eliminate compiler warning for unused do_pk8pkey_fp(). +Disable TEST_ENG_OPENSSL_PKEY. +Disable GOST engine as is uses [f]printf all over the place. +Eliminate compiler warning for unused send_fp_chars(). Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-16Fix return values when adding serverinfo fails.Kurt Roeckx1-8/+10
Reviewed-by: Rich Salz <rsalz@openssl.org> MR #1128
2015-08-31Add X509_up_ref function.Dr. Stephen Henson1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-22Remove support for OPENSSL_NO_TLSEXTMatt Caswell1-4/+2
Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-19move masks out of CERT structureDr. Stephen Henson1-2/+0
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-08Add SSL_use_certificate_chain_file functionDr. Stephen Henson1-12/+33
Add SSL_use_certiicate_chain file functions: this is works the same way as SSL_CTX_use_certificate_chain_file but for an SSL structure. Update SSL_CONF code to use the new function. Update docs. Update ordinals. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-01free NULL cleanup -- codaRich Salz1-5/+2
After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-04-30free NULL cleanup 5aRich Salz1-6/+3
Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-16Code style: space after 'if'Viktor Dukhovni1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-25free NULL cleanupRich Salz1-16/+8
This commit handles BIO_ACCEPT_free BIO_CB_FREE BIO_CONNECT_free BIO_free BIO_free_all BIO_vfree Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-23Fix missing return value checksMatt Caswell1-1/+4
Ensure that all functions have their return values checked where appropriate. This covers all functions defined and called from within libssl. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-03-15Remove ssl_cert_inst()Kurt Roeckx1-28/+0
It created the cert structure in SSL_CTX or SSL if it was NULL, but they can never be NULL as the comments already said. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2015-01-29clang on Linux x86_64 complains about unreachable code.Richard Levitte1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell1-948/+889
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-12-10serverinfo_process_buffer: check result of ↵Jonas Maebe1-2/+5
realloc(ctx->cert->key->serverinfo) and don't leak memory if it fails Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org>
2014-08-28Rename some callbacks, fix alignment.Dr. Stephen Henson1-6/+6
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-28Use consistent function naming.Dr. Stephen Henson1-1/+1
Instead of SSL_CTX_set_custom_cli_ext and SSL_CTX_set_custom_srv_ext use SSL_CTX_add_client_custom_ext and SSL_CTX_add_server_custom_ext. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-28New extension callback features.Dr. Stephen Henson1-2/+4
Support separate parse and add callback arguments. Add new callback so an application can free extension data. Change return value for send functions so < 0 is an error 0 omits extension and > 0 includes it. This is more consistent with the behaviour of other functions in OpenSSL. Modify parse_cb handling so <= 0 is an error. Make SSL_CTX_set_custom_cli_ext and SSL_CTX_set_custom_cli_ext argument order consistent. NOTE: these changes WILL break existing code. Remove (now inaccurate) in line documentation. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-28Callback revision.Dr. Stephen Henson1-12/+12
Use "parse" and "add" for function and callback names instead of "first" and "second". Change arguments to callback so the extension type is unsigned int and the buffer length is size_t. Note: this *will* break existing code. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-28Remove serverinfo checks.Dr. Stephen Henson1-39/+0
Since sanity checks are performed for all custom extensions the serverinfo checks are no longer needed. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2014-08-09RT 1988: Add "const" to SSL_use_RSAPrivateKey_ASN1Viktor Szakats1-1/+1
The "unsigned char *d" should be const. Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
2014-03-28Security framework.Dr. Stephen Henson1-0/+15
Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
2014-02-05Fix whitespace, new-style comments.Ben Laurie1-9/+11
2014-02-05Re-add alert variables removed during rebaseScott Deboy1-45/+45
Whitespace fixes
2014-02-05Update custom TLS extension and supplemental data 'generate' callbacks to ↵Scott Deboy1-1/+40
support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.
2014-01-03Use algorithm specific chains for certificates.Dr. Stephen Henson1-7/+3
Fix a limitation in SSL_CTX_use_certificate_chain_file(): use algorithm specific chains instead of the shared chain. Update docs.
2013-09-25Show useful errors.Ben Laurie1-4/+4
Conflicts: apps/s_server.c
2013-09-13Require ServerInfo PEMs to be named "BEGIN SERVERINFO FOR"...Trevor Perrin1-2/+14
2013-09-13Redo deletion of some serverinfo code that supplemental data code mistakenly ↵Trevor Perrin1-9/+0
reinstated.
2013-09-06Add callbacks supporting generation and retrieval of supplemental data ↵Scott Deboy1-224/+9
entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
2013-07-31Various custom extension fixes.Trevor Perrin1-19/+2
Force no SSL2 when custom extensions in use. Don't clear extension state when cert is set. Clear on renegotiate.
2013-06-28Cosmetic touchups.Trevor1-1/+1
2013-06-18Cleanup of custom extension stuff.Trevor1-20/+42
serverinfo rejects non-empty extensions. Omit extension if no relevant serverinfo data. Improve error-handling in serverinfo callback. Cosmetic cleanups. s_client documentation. s_server documentation. SSL_CTX_serverinfo documentation. Cleaup -1 and NULL callback handling for custom extensions, add tests. Cleanup ssl_rsa.c serverinfo code. Whitespace cleanup. Improve comments in ssl.h for serverinfo. Whitespace. Cosmetic cleanup. Reject non-zero-len serverinfo extensions. Whitespace. Make it build.
2013-06-12Add support for arbitrary TLS extensions.Trevor1-1/+243
Contributed by Trevor Perrin.
2012-06-07Rearrange and test authz extension.Ben Laurie1-0/+126
2012-05-30RFC 5878 support.Ben Laurie1-5/+115
2012-01-16Support for fixed DH ciphersuites.Dr. Stephen Henson1-2/+17
The cipher definitions of these ciphersuites have been around since SSLeay but were always disabled. Now OpenSSL supports DH certificates they can be finally enabled. Various additional changes were needed to make them work properly: many unused fixed DH sections of code were untested.
2009-09-12PR: 1411Dr. Stephen Henson1-1/+1
Submitted by: steve@openssl.org Allow use of trusted certificates in SSL_CTX_use_chain_file()
2008-05-26Reword comment to be much shorter to stop other people from complainingLutz Jänicke1-5/+1
about "overcommenting".
2008-05-23Clear error queue when starting SSL_CTX_use_certificate_chain_fileLutz Jänicke1-0/+6
PR: 1417, 1513 Submitted by: Erik de Castro Lopo <mle+openssl@mega-nerd.com>
2005-04-08add support for DER encoded private keys to SSL_CTX_use_PrivateKey_file()Nils Larsch1-0/+10
and SSL_use_PrivateKey_file() PR: 1035 Submitted by: Walter Goulet Reviewed by: Nils Larsch
2005-04-07get rid of very buggy and very imcomplete DH cert supportNils Larsch1-68/+18
Reviewed by: Bodo Moeller
2005-04-01really clear the error queue hereNils Larsch1-1/+1
PR: 860
2004-03-15Constify d2i, s2i, c2i and r2i functions and other associatedRichard Levitte1-7/+7
functions and macros. This change has associated tags: LEVITTE_before_const and LEVITTE_after_const. Those will be removed when this change has been properly reviewed.
2003-08-11make sure no error is left in the queue that is intentionally ignoredBodo Möller1-1/+3
2002-07-10Reorder inclusion of header files:Lutz Jänicke1-1/+1
des_old.h redefines crypt: #define crypt(b,s)\ DES_crypt((b),(s)) This scheme leads to failure, if header files with the OS's true definition of crypt() are processed _after_ des_old.h was processed. This is e.g. the case on HP-UX with unistd.h. As evp.h now again includes des.h (which includes des_old.h), this problem only came up after this modification. Solution: move header files (indirectly) including e_os.h before the header files (indirectly) including evp.h. Submitted by: Reviewed by: PR:
2002-02-28use ERR_peek_last_error() instead of ERR_peek_error()Bodo Möller1-2/+2
generated by cgit v1.1 at 2024-07-12 22:34:09 +0000