openssl

Author	SHA1	Message	Date
Felix Laurie von Massenbach	b5419b81ac	Add speed test for prime trial division.	2014-06-01 15:31:26 +01:00
Matt Caswell	3d9243f1b6	Changed -strictpem to use PEM_read_bio	2014-05-26 23:31:37 +01:00
Matt Caswell	6b5c1d940b	Added -strictpem parameter to enable processing of PEM files with data prior to the BEGIN marker	2014-05-26 17:24:11 +01:00
Martin Kaiser	c5f0b9bd86	Modify the description of -noout to match the manpage. PR#3364	2014-05-24 00:04:25 +01:00
Martin Kaiser	189ae368d9	Add an NSS output format to sess_id to export to export the session id and the master key in NSS keylog format. PR#3352	2014-05-24 00:02:24 +01:00
Dr. Stephen Henson	6f719f063c	Change default cipher in smime app to des3. PR#3357	2014-05-21 11:28:57 +01:00
Dr. Stephen Henson	c358651218	Enc doesn't support AEAD ciphers. (cherry picked from commit 09184dddead165901700b31eb39d540ba30f93c5)	2014-05-15 14:16:46 +01:00
Viktor Dukhovni	b00676bb6f	Fix infinite loop. PR#3347	2014-05-11 20:28:56 +01:00
Geoff Thorpe	a935132099	s_client/s_server: support unix domain sockets The "-unix <path>" argument allows s_server and s_client to use a unix domain socket in the filesystem instead of IPv4 ("-connect", "-port", "-accept", etc). If s_server exits gracefully, such as when "-naccept" is used and the requested number of SSL/TLS connections have occurred, then the domain socket file is removed. On ctrl-C, it is likely that the stale socket file will be left over, such that s_server would normally fail to restart with the same arguments. For this reason, s_server also supports an "-unlink" option, which will clean up any stale socket file before starting. If you have any reason to want encrypted IPC within an O/S instance, this concept might come in handy. Otherwise it just demonstrates that there is nothing about SSL/TLS that limits it to TCP/IP in any way. (There might also be benchmarking and profiling use in this path, as unix domain sockets are much lower overhead than connecting over local IP addresses). Signed-off-by: Geoff Thorpe <geoff@openssl.org>	2014-05-08 22:07:09 -04:00
Tim Hudson	b6e69d284b	coverity 966576 - close socket in error path	2014-05-08 23:14:52 +01:00
Tim Hudson	8e94fadd0b	PR#3342 fix resource leak coverity issue 966577	2014-05-08 23:08:33 +01:00
Geoff Thorpe	e1ce131d4d	apps/s_server: document '-naccept' cmd-line argument Signed-off-by: Geoff Thorpe <geoff@openssl.org>	2014-05-04 22:42:41 -04:00
Geoff Thorpe	79c6c4e828	make depend	2014-04-25 14:31:05 -04:00
Geoff Thorpe	76c3ff6937	apps: constify some string parameters There are certainly many more constifiable strings in the various interfaces, which I hope to get to eventually. Signed-off-by: Geoff Thorpe <geoff@openssl.org>	2014-04-25 14:31:05 -04:00
Dr. Stephen Henson	5219d3dd35	Fix free errors in ocsp utility. Keep copy of any host, path and port values allocated by OCSP_parse_url and free as necessary.	2014-04-09 15:42:40 +01:00
Dr. Stephen Henson	7ba08a4d73	Use correct length when prompting for password. Use bufsiz - 1 not BUFSIZ - 1 when prompting for a password in the openssl utility. Thanks to Rob Mackinnon, Leviathan Security for reporting this issue.	2014-04-04 12:44:43 +01:00
Tim Hudson	de2d97cd79	Add option to generate old hash format. New -hash_old to generate CRL hashes using old (before OpenSSL 1.0.0) algorithm.	2014-04-03 13:26:32 +01:00
Ben Laurie	5a49001bde	Fix warning.	2014-03-29 19:51:58 +00:00
Dr. Stephen Henson	e03c5b59f0	Security callback debug print out. Add a debugging security callback option to s_client/s_server. This will print out each security parameter as it is accepted or rejected.	2014-03-28 14:56:43 +00:00
Dr. Stephen Henson	8b8e5bed23	Allow return of supported ciphers. New function ssl_cipher_disabled. Check for disabled client ciphers using ssl_cipher_disabled. New function to return only supported ciphers. New option to ciphers utility to print only supported ciphers.	2014-03-28 14:49:04 +00:00
Dr. Stephen Henson	09599b52d4	Auto DH support. Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be very slow. The old export ciphersuites aren't supported but those are very insecure anyway.	2014-03-28 14:49:04 +00:00
Dr. Stephen Henson	f0ef019da2	Add -no_resumption_on_reneg to SSL_CONF. (cherry picked from commit `1f44dac24d`)	2014-03-27 16:12:40 +00:00
Dr. Stephen Henson	5693a30813	PKCS#8 support for alternative PRFs. Add option to set an alternative to the default hmacWithSHA1 PRF for PKCS#8 private key encryptions. This is used automatically by PKCS8_encrypt if the nid specified is a PRF. Add option to pkcs8 utility. Update docs. (cherry picked from commit `b60272b01f`)	2014-03-01 23:16:08 +00:00
Dr. Stephen Henson	86a2f966d0	Add -show_chain option to print out verified chain.	2014-02-25 14:05:22 +00:00
Dr. Stephen Henson	a4cc3c8041	Avoid Windows 8 Getversion deprecated errors. Windows 8 SDKs complain that GetVersion() is deprecated. We only use GetVersion like this: (GetVersion() < 0x80000000) which checks if the Windows version is NT based. Use a macro check_winnt() which uses GetVersion() on older SDK versions and true otherwise.	2014-02-25 13:40:33 +00:00
Dr. Stephen Henson	13dc3ce9ab	New chain building flags. New flags to build certificate chains. The can be used to rearrange the chain so all an application needs to do is add all certificates in arbitrary order and then build the chain to check and correct them. Add verify error code when building chain. Update docs.	2014-02-23 13:36:38 +00:00
Dr. Stephen Henson	8764e86339	make depend	2014-02-20 18:48:56 +00:00
Dr. Stephen Henson	ded18639d7	Move CT viewer extension code to crypto/x509v3	2014-02-20 18:48:56 +00:00
Dr. Stephen Henson	4cfeb00be9	make depend	2014-02-19 20:09:08 +00:00
Rob Stradling	b263f21246	Move the SCT List extension parser into libssl. Add the extension parser in the s_client, ocsp and x509 apps.	2014-02-19 13:12:46 +00:00
Kurt Roeckx	3343220327	Use defaults bits in req when not given If you use "-newkey rsa" it's supposed to read the default number of bits from the config file. However the value isn't used to generate the key, but it does print it's generating such a key. The set_keygen_ctx() doesn't call EVP_PKEY_CTX_set_rsa_keygen_bits() and you end up with the default set in pkey_rsa_init() (1024). Afterwards the number of bits gets read from the config file, but nothing is done with that anymore. We now read the config first and use the value from the config file when no size is given. PR: 2592	2014-02-14 22:30:27 +00:00
Scott Schaefer	2b4ffc659e	Fix various spelling errors	2014-02-14 22:29:12 +00:00
Dr. Stephen Henson	847865d0f9	Add suppot for ASCII with CRLF canonicalisation.	2014-02-13 14:35:56 +00:00
Ben Laurie	0a6028757a	Fix whitespace, new-style comments.	2014-02-05 18:25:46 +00:00
Scott Deboy	e9add063b5	Re-add alert variables removed during rebase Whitespace fixes	2014-02-05 18:25:46 +00:00
Scott Deboy	ac20719d99	Update custom TLS extension and supplemental data 'generate' callbacks to support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.	2014-02-05 18:25:46 +00:00
Dr. Stephen Henson	3323314fc1	Add cert callback retry test.	2014-01-26 16:29:50 +00:00
Piotr Sikora	2911575c6e	Fix compilation with no-nextprotoneg. PR#3106	2013-11-14 01:20:12 +00:00
Dr. Stephen Henson	ec2f7e568e	Extend SSL_CONF Extend SSL_CONF to return command value types. Add certificate and key options. Update documentation.	2013-10-20 22:07:36 +01:00
Ben Laurie	c45a48c186	Constification.	2013-10-07 12:45:26 +01:00
Ben Laurie	70d416ec35	Produce PEM we would consume.	2013-09-25 13:57:36 +01:00
Ben Laurie	9725bda766	Show useful errors. Conflicts: apps/s_server.c	2013-09-25 12:45:48 +01:00
Mat	5628ec6673	typo	2013-09-13 14:29:36 +01:00
Scott Deboy	b0d27cb902	Initialize next_proto in s_server - resolves incorrect attempts to free	2013-09-11 17:22:00 -07:00
Dr. Stephen Henson	5e3ff62c34	Experimental encrypt-then-mac support. Experimental support for encrypt then mac from draft-gutmann-tls-encrypt-then-mac-02.txt To enable it set the appropriate extension number (0x10 for the test server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x10 For non-compliant peers (i.e. just about everything) this should have no effect.	2013-09-08 13:14:03 +01:00
Ben Laurie	1769dfab06	Const fix.	2013-09-06 14:03:28 +01:00
Scott Deboy	67c408cee9	Free generated supp data after handshake completion, add comment regarding use of num_renegotiations in TLS and supp data generation callbacks	2013-09-06 13:59:14 +01:00
Ben Laurie	5eda213ebe	More cleanup.	2013-09-06 13:59:14 +01:00
Ben Laurie	a6a48e87bc	Make it build.	2013-09-06 13:59:13 +01:00
Scott Deboy	36086186a9	Add callbacks supporting generation and retrieval of supplemental data entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.	2013-09-06 13:59:13 +01:00
Veres Lajos	478b50cf67	misspellings fixes by https://github.com/vlajos/misspell_fixer	2013-09-05 21:39:42 +01:00
Ben Laurie	d2625fd657	Clean up layout.	2013-09-05 17:28:05 +01:00
Carlos Alberto Lopez Perez	b98af49d97	Add an "-xmpphost" option to s_client * Many XMPP servers are configured with multiple domains (virtual hosts) * In order to establish successfully the TLS connection you have to specify which virtual host you are trying to connect. * Test this, for example with :: * Fail: openssl s_client -connect talk.google.com:5222 -starttls xmpp * Works: openssl s_client -connect talk.google.com:5222 -starttls xmpp -xmpphost gmail.com	2013-09-05 17:24:56 +01:00
Carlos Alberto Lopez Perez	4249d4ba86	Fix infinite loop on s_client starttls xmpp * When the host used in "-connect" is not what the remote XMPP server expects the server will return an error like this: <stream:error> <host-unknown xmlns='urn:ietf:params:xml:ns:xmpp-streams'/> </stream:error> * But the actual code will stay on the loop forever because the stop condition "/stream:features>" will never happen, * Make this more robust: The stop condition should be that BIO_read failed * Test if for example with :: openssl s_client -connect random.jabb3r.net:5222 -starttls xmpp	2013-09-05 17:24:56 +01:00
Carlos Alberto Lopez Perez	4e48c77572	Fix XMPP code detection on s_client starttls xmpp * Some XMPP Servers (OpenFire) use double quotes. * This makes s_client starttls work with this servers. * Tested with OpenFire servers from http://xmpp.net/ :: openssl s_client -connect coderollers.com:5222 -starttls xmpp	2013-09-05 17:24:55 +01:00
Dr. Stephen Henson	fcb2bcfe65	Typo: don't call RAND_cleanup during app startup. (cherry picked from commit `90e7f983b5`)	2013-08-18 19:06:51 +01:00
Dr. Stephen Henson	14536c8c9c	Make no-ec compilation work.	2013-08-17 17:41:13 +01:00
Adam Langley	a898936218	Add tests for ALPN functionality. Conflicts: ssl/ssltest.c	2013-07-22 15:47:48 +01:00
Adam Langley	6f017a8f9d	Support ALPN. This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c	2013-07-22 15:28:20 +01:00
Dr. Stephen Henson	5711885a2b	Custom key wrap option for cms utility.	2013-07-17 21:45:01 +01:00
Dr. Stephen Henson	02498cc885	Add -keyopt option to cms utility. Add support for custom public key parameters in the cms utility using the -keyopt switch. Works for -sign and also -encrypt if -recip is used.	2013-06-21 23:43:06 +01:00
Trevor	a398f821fa	Add support for arbitrary TLS extensions. Contributed by Trevor Perrin.	2013-06-12 17:01:13 +01:00
Dr. Stephen Henson	c6913eeb76	Dual DTLS version methods. Add new methods DTLS_*_method() which support both DTLS 1.0 and DTLS 1.2 and pick the highest version the peer supports during negotiation. As with SSL/TLS options can change this behaviour specifically SSL_OP_NO_DTLSv1 and SSL_OP_NO_DTLSv1_2.	2013-04-09 14:02:48 +01:00
Dr. Stephen Henson	3d1160d58b	Call RAND_cleanup in openssl application. (cherry picked from commit `944bc29f90`)	2013-03-28 14:29:39 +00:00
Dr. Stephen Henson	c3b344e36a	Provisional DTLS 1.2 support. Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing.	2013-03-26 15:16:41 +00:00
Andy Polyakov	a006fef78e	Improve WINCE support. Submitted by: Pierre Delaage	2013-01-19 21:23:13 +01:00
Dr. Stephen Henson	4badfebefc	Typo (PR2959).	2013-01-17 18:20:18 +00:00
Dr. Stephen Henson	abd01ea214	Change default bits to 1024	2013-01-07 16:18:31 +00:00
Dr. Stephen Henson	b252cf0d98	make JPAKE work again, fix memory leaks	2012-12-29 23:38:20 +00:00
Dr. Stephen Henson	89a5e2f704	missing tab	2012-12-26 19:12:57 +00:00
Dr. Stephen Henson	09d0d67c13	add missing newline	2012-12-21 16:24:48 +00:00
Dr. Stephen Henson	bbdfbacdef	add -rmd option to set OCSP response signing digest	2012-12-16 00:10:03 +00:00
Dr. Stephen Henson	99fc818e93	Return success when the responder is active. Don't verify our own responses.	2012-12-15 02:56:02 +00:00
Dr. Stephen Henson	265f835e3e	typo	2012-12-15 00:29:12 +00:00
Dr. Stephen Henson	33826fd028	Add support for '-' as input and output filenames in ocsp utility. Recognise verification arguments.	2012-12-14 23:30:56 +00:00
Dr. Stephen Henson	92821996de	oops, revert, committed in error	2012-12-14 23:29:58 +00:00
Dr. Stephen Henson	11e2957d5f	apps/ocsp.c	2012-12-14 23:28:19 +00:00
Dr. Stephen Henson	51e7a4378a	New verify flag to return success if we have any certificate in the trusted store instead of the default which is to return an error if we can't build the complete chain.	2012-12-13 18:14:46 +00:00
Dr. Stephen Henson	60938ae772	add -crl_download option to s_server	2012-12-12 03:35:31 +00:00
Dr. Stephen Henson	4e71d95260	add -cert_chain option to s_client	2012-12-12 00:50:26 +00:00
Ben Laurie	fefc111a2a	Make openssl verify return errors.	2012-12-11 16:05:14 +00:00
Dr. Stephen Henson	1e8b9e7e69	add -badsig option to ocsp utility too.	2012-12-09 16:21:46 +00:00
Ben Laurie	30c278aa6b	Fix OCSP checking.	2012-12-07 18:47:47 +00:00
Dr. Stephen Henson	0090a686c0	Add code to download CRLs based on CRLDP extension. Just a sample, real world applications would have to be cleverer.	2012-12-06 18:43:40 +00:00
Dr. Stephen Henson	f5a7d5b164	remove print_ssl_cert_checks() from openssl application: it is no longer used	2012-12-06 18:36:51 +00:00
Dr. Stephen Henson	3bf15e2974	Integrate host, email and IP address checks into X509_verify. Add new verify options to set checks. Remove previous -check* commands from s_client and s_server.	2012-12-05 18:35:20 +00:00
Dr. Stephen Henson	fbeb85ecb9	don't print verbose policy check messages when -quiet is selected even on error	2012-12-04 23:18:44 +00:00
Dr. Stephen Henson	2e8cb108dc	initial support for delta CRL generations by diffing two full CRLs	2012-12-04 18:35:36 +00:00
Dr. Stephen Henson	256f9573c5	make -subj always override config file	2012-12-04 18:35:04 +00:00
Dr. Stephen Henson	b6b094fb77	check mval for NULL too	2012-12-04 17:25:34 +00:00
Dr. Stephen Henson	0db46a7dd7	fix leak	2012-12-03 16:32:52 +00:00
Dr. Stephen Henson	2537d46903	oops, really check brief mode only ;-)	2012-12-03 03:40:57 +00:00
Dr. Stephen Henson	5447f836a0	don't check errno is zero, just print out message	2012-12-03 03:39:23 +00:00
Dr. Stephen Henson	66d9f2e521	if no error code and -brief selected print out connection closed instead of read error	2012-12-03 03:33:44 +00:00
Dr. Stephen Henson	139cd16cc5	add -badsig option to corrupt CRL signatures for testing too	2012-12-02 16:48:25 +00:00
Dr. Stephen Henson	fdb78f3d88	New option to add CRLs for s_client and s_server.	2012-12-02 16:16:28 +00:00
Dr. Stephen Henson	95ea531864	add option to get a certificate or CRL from a URL	2012-12-02 14:00:22 +00:00
Dr. Stephen Henson	df316fd43c	Add new test option set the version in generated certificates: this is needed to test some profiles/protocols which reject certificates with unsupported versions.	2012-11-30 19:24:13 +00:00
Dr. Stephen Henson	84bafb7471	Print out point format list for clients too.	2012-11-26 18:39:38 +00:00
Dr. Stephen Henson	55b66f084d	set cmdline flag in s_server	2012-11-26 12:51:12 +00:00
Dr. Stephen Henson	96cfba0fb4	option to output corrupted signature in certificates for testing purposes	2012-11-25 22:29:52 +00:00
Dr. Stephen Henson	a5afc0a8f4	Don't display messages about verify depth in s_server if -quiet it set. Add support for separate verify and chain stores in s_client.	2012-11-23 18:56:25 +00:00
Dr. Stephen Henson	20b431e3a9	Add support for printing out and retrieving EC point formats extension.	2012-11-22 15:20:53 +00:00
Dr. Stephen Henson	1740c9fbfc	support -quiet with -msg or -trace	2012-11-21 17:11:42 +00:00
Dr. Stephen Henson	191b3f0ba9	only use a default curve if not already set	2012-11-21 16:47:25 +00:00
Dr. Stephen Henson	5c1393bfc3	PR: 2908 Submitted by: Dmitry Belyavsky <beldmit@gmail.com> Fix DH double free if parameter generation fails.	2012-11-21 14:02:40 +00:00
Dr. Stephen Henson	f7ac0ec89d	fix printout of expiry days if -enddate is used in ca	2012-11-20 15:22:15 +00:00
Dr. Stephen Henson	22b5d7c80b	fix leaks	2012-11-20 00:24:52 +00:00
Dr. Stephen Henson	685755937a	with -rev close connection if client sends "CLOSE"	2012-11-19 23:41:24 +00:00
Dr. Stephen Henson	7c8ac50504	update usage messages	2012-11-19 23:20:40 +00:00
Dr. Stephen Henson	98a7edf9f0	make depend	2012-11-19 13:18:09 +00:00
Dr. Stephen Henson	7831969634	don't call gethostbyname if OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL is set	2012-11-19 12:36:04 +00:00
Dr. Stephen Henson	9ba297e49f	remove obsolete code	2012-11-19 03:46:49 +00:00
Dr. Stephen Henson	b5cadfb564	add -naccept <n> option to s_server to automatically exit after <n> connections	2012-11-18 15:45:16 +00:00
Dr. Stephen Henson	9fc81acae6	fix error messages	2012-11-17 15:22:50 +00:00
Dr. Stephen Henson	5d2e07f182	Delegate command line handling for many common options in s_client/s_server to the SSL_CONF APIs. This is complicated a little because the SSL_CTX structure is not available when the command line is processed: so just check syntax of commands initially and store them, ready to apply later.	2012-11-17 14:42:22 +00:00
Dr. Stephen Henson	51b9115b6d	new command line option -stdname to ciphers utility	2012-11-16 00:35:46 +00:00
Dr. Stephen Henson	95bba34b83	contify	2012-11-05 19:38:32 +00:00
Dr. Stephen Henson	671c9e2dc8	oops, fix compilation errors in s_server	2012-10-11 18:03:42 +00:00
Dr. Stephen Henson	a70da5b3ec	New functions to check a hostname email or IP address against a certificate. Add options to s_client, s_server and x509 utilities to print results of checks.	2012-10-08 15:10:07 +00:00
Andy Polyakov	27e0c86307	md5-sparcv9.pl: more accurate performance result.	2012-09-28 09:25:49 +00:00
Dr. Stephen Henson	4f3df8bea2	Add -rev test option to s_server to just reverse order of characters received by client and send back to server. Also prints an abbreviated summary of the connection parameters.	2012-09-14 13:27:05 +00:00
Dr. Stephen Henson	2a7cbe77b3	Add -brief option to s_client and s_server to summarise connection details. New option -verify_quiet to shut up the verify callback unless there is an error.	2012-09-12 23:14:28 +00:00
Dr. Stephen Henson	0a17b8de06	fix memory leak	2012-09-11 13:43:57 +00:00
Dr. Stephen Henson	147d4c96b0	fix memory leak	2012-09-09 21:19:32 +00:00
Dr. Stephen Henson	648f551a4a	New -valid option to add a certificate to the ca index.txt that is valid and not revoked	2012-09-09 12:58:49 +00:00
Dr. Stephen Henson	33a8de69dc	new ctrl to retrive value of received temporary key in server key exchange message, print out details in s_client	2012-09-08 13:59:51 +00:00
Dr. Stephen Henson	319354eb6c	store and print out message digest peer signed with in TLS 1.2	2012-09-07 12:53:42 +00:00
Dr. Stephen Henson	ed83ba5321	Add compilation flag to disable certain protocol checks and allow use of some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.	2012-08-29 13:18:34 +00:00
Bodo Möller	619aab841c	Oops - didn't mean to change Makefile on previous submit	2012-08-16 13:49:34 +00:00
Bodo Möller	a4aafeeef4	Enable message names for TLS 1.1, 1.2 with -msg.	2012-08-16 13:41:40 +00:00
Dr. Stephen Henson	2ea8035460	Add three Suite B modes to TLS code, supporting RFC6460.	2012-08-15 15:15:05 +00:00
Dr. Stephen Henson	3ad344a517	add suite B chain validation flags and associated verify errors	2012-08-03 13:51:43 +00:00
Dr. Stephen Henson	6dbb6219e7	Make tls1_check_chain return a set of flags indicating checks passed by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.	2012-07-27 13:39:23 +00:00
Dr. Stephen Henson	74ecfab401	Add support for certificate stores in CERT structure. This makes it possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.	2012-07-23 23:34:28 +00:00
Dr. Stephen Henson	9f27b1eec3	Add new ctrl to retrieve client certificate types, print out details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.	2012-07-08 14:22:45 +00:00
Dr. Stephen Henson	dd25165968	Fix memory leak. Always perform nexproto callback argument initialisation in s_server otherwise we use uninitialised data if -nocert is specified.	2012-07-03 16:37:50 +00:00
Dr. Stephen Henson	657e29c199	cert_flags is unsigned	2012-07-03 14:54:59 +00:00
Dr. Stephen Henson	3208fc59db	add support for client certificate callbak, fix memory leak	2012-07-03 14:53:27 +00:00
Dr. Stephen Henson	3dbc46dfcd	Separate client and server permitted signature algorithm support: by default the permitted signature algorithms for server and client authentication are the same but it is now possible to set different algorithms for client authentication only.	2012-07-03 12:51:14 +00:00
Dr. Stephen Henson	18d7158809	Add certificate callback. If set this is called whenever a certificate is required by client or server. An application can decide which certificate chain to present based on arbitrary criteria: for example supported signature algorithms. Add very simple example to s_server. This fixes many of the problems and restrictions of the existing client certificate callback: for example you can now clear existing certificates and specify the whole chain.	2012-06-29 14:24:42 +00:00
Dr. Stephen Henson	d61ff83be9	Add new "valid_flags" field to CERT_PKEY structure which determines what the certificate can be used for (if anything). Set valid_flags field in new tls1_check_chain function. Simplify ssl_set_cert_masks which used to have similar checks in it. Add new "cert_flags" field to CERT structure and include a "strict mode". This enforces some TLS certificate requirements (such as only permitting certificate signature algorithms contained in the supported algorithms extension) which some implementations ignore: this option should be used with caution as it could cause interoperability issues.	2012-06-28 12:45:49 +00:00
Dr. Stephen Henson	4453cd8c73	Reorganise supported signature algorithm extension processing. Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.	2012-06-25 14:32:30 +00:00
Dr. Stephen Henson	0f229cce65	Add support for application defined signature algorithms for use with TLS v1.2. These are sent as an extension for clients and during a certificate request for servers. TODO: add support for shared signature algorithms, respect shared algorithms when deciding which ciphersuites and certificates to permit.	2012-06-22 14:03:31 +00:00
Dr. Stephen Henson	020091406c	oops, add -debug_decrypt option which was accidenatally left out	2012-06-19 13:39:30 +00:00
Dr. Stephen Henson	93ab9e421e	Initial record tracing code. Print out all fields in SSL/TLS records for debugging purposes. Needs "enable-ssl-trace" configuration option.	2012-06-15 12:46:09 +00:00
Ben Laurie	7a71af86ce	Rearrange and test authz extension.	2012-06-07 13:20:47 +00:00
Ben Laurie	71fa451343	Version skew reduction: trivia (I hope).	2012-06-03 22:00:21 +00:00
Ben Laurie	a9e1c50bb0	RFC 5878 support.	2012-05-30 10:10:58 +00:00
Dr. Stephen Henson	ce33b42bc6	oops, not yet ;-)	2012-04-23 21:58:29 +00:00
Dr. Stephen Henson	579d553464	update NEWS	2012-04-23 21:56:33 +00:00
Dr. Stephen Henson	fc6fc7ff38	Add options to set additional type specific certificate chains to s_server.	2012-04-11 16:53:11 +00:00
Dr. Stephen Henson	a43526302f	Add support for automatic ECDH temporary key parameter selection. When enabled instead of requiring an application to hard code a (possibly inappropriate) parameter set and delve into EC internals we just automatically use the preferred curve.	2012-04-05 13:38:27 +00:00
Dr. Stephen Henson	d0595f170c	Initial revision of ECC extension handling. Tidy some code up. Don't allocate a structure to handle ECC extensions when it is used for default values. Make supported curves configurable. Add ctrls to retrieve shared curves: not fully integrated with rest of ECC code yet.	2012-03-28 15:05:04 +00:00
Dr. Stephen Henson	bbbe61c958	Always use SSLv23_{client,server}_method in s_client.c and s_server.c, the old code came from SSLeay days before TLS was even supported.	2012-03-18 18:16:46 +00:00
Dr. Stephen Henson	156421a2af	oops, revert unrelated patches	2012-03-14 13:46:50 +00:00
Dr. Stephen Henson	61ad8262a0	update FAQ, NEWS	2012-03-14 13:44:57 +00:00
Dr. Stephen Henson	15a40af2ed	Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Add more extension names in s_cb.c extension printing code.	2012-03-09 18:38:35 +00:00
Dr. Stephen Henson	e7f8ff4382	New ctrls to retrieve supported signature algorithms and curves and extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.	2012-03-06 14:28:21 +00:00
Dr. Stephen Henson	64095ce9d7	Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert between NIDs and the more common NIST names such as "P-256". Enhance ecparam utility and ECC method to recognise the NIST names for curves.	2012-02-21 14:41:13 +00:00
Dr. Stephen Henson	fc7dae5229	PR: 2717 Submitted by: Tim Rice <tim@multitalents.net> Make compilation work on OpenServer 5.0.7	2012-02-11 23:41:19 +00:00
Dr. Stephen Henson	be81f4dd81	PR: 2716 Submitted by: Adam Langley <agl@google.com> Fix handling of exporter return value and use OpenSSL indentation in s_client, s_server.	2012-02-11 23:20:53 +00:00
Andy Polyakov	cbc0b0ec2d	apps/s_cb.c: recognized latest TLS version.	2012-02-11 13:30:47 +00:00
Dr. Stephen Henson	3770b988c0	PR: 2710 Submitted by: Tomas Mraz <tmraz@redhat.com> Check return codes for load_certs_crls.	2012-02-10 19:54:54 +00:00
Dr. Stephen Henson	9641be2aac	PR: 2714 Submitted by: Tomas Mraz <tmraz@redhat.com> Make no-srp work.	2012-02-10 19:43:14 +00:00
Dr. Stephen Henson	7951c2699f	add fips blocking overrides to command line utilities	2012-02-10 16:47:40 +00:00
Dr. Stephen Henson	57559471bf	oops, revert unrelated changes	2012-02-09 15:43:58 +00:00
Dr. Stephen Henson	f4e1169341	Modify client hello version when renegotiating to enhance interop with some servers.	2012-02-09 15:42:10 +00:00
Dr. Stephen Henson	2ff5ac55c5	oops revert debug change	2012-01-22 13:52:39 +00:00
Dr. Stephen Henson	855d29184e	Fix for DTLS DoS issue introduced by fix for CVE-2011-4109. Thanks to Antonio Martin, Enterprise Secure Access Research and Development, Cisco Systems, Inc. for discovering this bug and preparing a fix. (CVE-2012-0050)	2012-01-18 18:15:27 +00:00
Andy Polyakov	a50bce82ec	Sanitize usage of <ctype.h> functions. It's important that characters are passed zero-extended, not sign-extended. PR: 2682	2012-01-12 16:21:35 +00:00
Andy Polyakov	5beb93e114	speed.c: typo in pkey_print_message. PR: 2681 Submitted by: Annie Yousar	2012-01-11 21:48:31 +00:00
Bodo Möller	6620bf3444	Fix usage indentation	2012-01-05 13:16:30 +00:00
Dr. Stephen Henson	4817504d06	PR: 2658 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.	2011-12-31 22:59:57 +00:00
Dr. Stephen Henson	84b6e277d4	make update	2011-12-27 14:46:03 +00:00
Dr. Stephen Henson	c79f22c63a	PR: 1794 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve - remove some unncessary SSL_err and permit an srp user callback to allow a worker to obtain a user verifier. - cleanup and comments in s_server and demonstration for asynchronous srp user lookup	2011-12-27 14:21:45 +00:00
Dr. Stephen Henson	f9b0b45238	New ctrl values to clear or retrieve extra chain certs from an SSL_CTX. New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.	2011-12-22 15:14:32 +00:00
Andy Polyakov	7aba22ba28	apps/speed.c: fix typo in last commit.	2011-12-19 14:33:09 +00:00
Andy Polyakov	bdba45957a	apps/speed.c: Cygwin alarm() fails sometimes. PR: 2655	2011-12-15 22:30:03 +00:00
Dr. Stephen Henson	f2fc30751e	PR: 1794 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Remove unnecessary code for srp and to add some comments to s_client. - the callback to provide a user during client connect is no longer necessary since rfc 5054 a connection attempt with an srp cipher and no user is terminated when the cipher is acceptable - comments to indicate in s_client the (non-)usefulness of th primalaty tests for non known group parameters.	2011-12-14 22:17:06 +00:00
Ben Laurie	9a436c0f89	Back out redundant verification time change.	2011-12-13 15:00:43 +00:00
Ben Laurie	7fd5df6b12	Make it possible to set a time for verification.	2011-12-13 14:38:12 +00:00
Dr. Stephen Henson	16363c0165	implement -attime option as a verify parameter then it works with all relevant applications	2011-12-10 00:37:22 +00:00
Dr. Stephen Henson	990390ab52	Replace expired test server and client certificates with new ones.	2011-12-08 14:44:05 +00:00
Dr. Stephen Henson	2ca873e8d8	transparently handle X9.42 DH parameters	2011-12-07 12:44:03 +00:00
Dr. Stephen Henson	df0cdf4ceb	The default CN prompt message can be confusing when often the CN needs to be the server FQDN: change it. [Reported by PSW Group]	2011-12-06 00:00:30 +00:00
Ben Laurie	e0af04056c	Add TLS exporter.	2011-11-15 23:50:52 +00:00
Ben Laurie	333f926d67	Add DTLS-SRTP.	2011-11-15 22:59:20 +00:00
Ben Laurie	ae55176091	Fix some warnings caused by __owur. Temporarily (I hope) remove the more aspirational __owur annotations.	2011-11-14 00:36:10 +00:00
Dr. Stephen Henson	0c58d22ad9	PR: 1794 Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Document unknown_psk_identify alert, remove pre-RFC 5054 string from ssl_stat.c	2011-11-13 13:13:01 +00:00
Dr. Stephen Henson	7d7c13cbab	Don't disable TLS v1.2 by default now.	2011-10-09 23:26:39 +00:00
Dr. Stephen Henson	43206a2d7c	New -force_pubkey option to x509 utility to supply a different public key to the one in a request. This is useful for cases where the public key cannot be used for signing e.g. DH.	2011-10-07 15:18:09 +00:00
Dr. Stephen Henson	1579e65604	use keyformat for -x509toreq, don't hard code PEM	2011-09-23 21:48:34 +00:00
Dr. Stephen Henson	07dda896cb	PR: 2347 Submitted by: Tomas Mraz <tmraz@redhat.com> Reviewed by: steve Fix usage message.	2011-09-23 13:12:25 +00:00
Dr. Stephen Henson	be1242cbd1	PR: 2527 Submitted by: Marcus Meissner <meissner@suse.de> Reviewed by: steve Set cnf to NULL to avoid possible double free.	2011-05-25 15:05:39 +00:00
Dr. Stephen Henson	086e32a6c7	Implement FIPS_mode and FIPS_mode_set	2011-05-19 18:09:02 +00:00
Dr. Stephen Henson	d39c495130	Enter FIPS mode by calling FIPS_module_mode_set in openssl.c until FIPS_mode_set is implemented.	2011-05-12 17:59:47 +00:00
Dr. Stephen Henson	4f7a2ab8b1	make kerberos work with OPENSSL_NO_SSL_INTERN	2011-05-11 22:50:18 +00:00
Dr. Stephen Henson	a2f9200fba	Initial TLS v1.2 client support. Include a default supported signature algorithms extension (including everything we support). Swicth to new signature format where needed and relax ECC restrictions. Not TLS v1.2 client certifcate support yet but client will handle case where a certificate is requested and we don't have one.	2011-05-09 15:44:01 +00:00
Dr. Stephen Henson	6b7be581e5	Continuing TLS v1.2 support: add support for server parsing of signature algorithms extension and correct signature format for server key exchange. All ciphersuites should now work on the server but no client support and no client certificate support yet.	2011-05-06 13:00:07 +00:00
Dr. Stephen Henson	7409d7ad51	Initial incomplete TLS v1.2 support. New ciphersuites added, new version checking added, SHA256 PRF support added. At present only RSA key exchange ciphersuites work with TLS v1.2 as the new signature format is not yet implemented.	2011-04-29 22:56:51 +00:00
Dr. Stephen Henson	08557cf22c	Initial "opaque SSL" framework. If an application defines OPENSSL_NO_SSL_INTERN all ssl related structures are opaque and internals cannot be directly accessed. Many applications will need some modification to support this and most likely some additional functions added to OpenSSL. The advantage of this option is that any application supporting it will still be binary compatible if SSL structures change.	2011-04-29 22:37:12 +00:00
Dr. Stephen Henson	69a80f7d5e	More fixes for DSA FIPS overrides.	2011-04-23 21:59:12 +00:00
Dr. Stephen Henson	dc03504d09	Make sure overrides work for RSA/DSA.	2011-04-23 21:15:05 +00:00
Dr. Stephen Henson	1ee49722dc	Add fips hmac key to dgst utility.	2011-04-06 23:40:46 +00:00
Dr. Stephen Henson	856650deb0	FIPS mode support for openssl utility: doesn't work properly yet due to missing DRBG support in libcrypto.	2011-04-04 17:16:28 +00:00
Richard Levitte	3a660e7364	Corrections to the VMS build system. Submitted by Steven M. Schweda <sms@antinode.info>	2011-03-25 16:20:35 +00:00
Richard Levitte	4ec3e8ca51	For VMS, implement the possibility to choose 64-bit pointers with different options: "64" The build system will choose /POINTER_SIZE=64=ARGV if the compiler supports it, otherwise /POINTER_SIZE=64. "64=" The build system will force /POINTER_SIZE=64. "64=ARGV" The build system will force /POINTER_SIZE=64=ARGV.	2011-03-25 09:40:48 +00:00
Richard Levitte	487b023f3d	make update (1.1.0-dev) This meant alarger renumbering in util/libeay.num due to symbols appearing in 1.0.0-stable and 1.0.1-stable. However, since there's been no release on this branch yet, it should be harmless.	2011-03-23 00:11:32 +00:00
Richard Levitte	2d1122b802	* apps/makeapps.com: Add srp.	2011-03-20 17:34:04 +00:00
Richard Levitte	f0d9196237	* apps/makeapps.com: Forgot to end the check for /POINTER_SIZE=64=ARGV with turning trapping back on. * test/maketests.com: Do the same check for /POINTER_SIZE=64=ARGV here. * test/clean-test.com: A new script for cleaning up.	2011-03-20 14:02:20 +00:00
Richard Levitte	8ecef24a66	* apps/openssl.c: For VMS, take care of copying argv if needed much earlier, directly in main(). 'if needed' also includes when argv is a 32 bit pointer in an otherwise 64 bit environment. * apps/makeapps.com: When using /POINTER_SIZE=64, try to use the additional =ARGV, but only if it's supported. Fortunately, DCL is very helpful telling us in this case.	2011-03-20 13:15:33 +00:00
Richard Levitte	537c982306	After some adjustments, apply the changes OpenSSL 1.0.0d on OpenVMS submitted by Steven M. Schweda <sms@antinode.info>	2011-03-19 10:58:14 +00:00
Dr. Stephen Henson	27131fe8f7	Fix warnings about ignored return values.	2011-03-17 14:43:13 +00:00
Ben Laurie	8cd3d99f57	Missing SRP files.	2011-03-16 11:50:33 +00:00
Dr. Stephen Henson	aa24c4a736	PR: 2469 Submitted by: Jim Studt <jim@studt.net> Reviewed by: steve Check mac is present before trying to retrieve mac iteration count.	2011-03-13 18:20:01 +00:00
Dr. Stephen Henson	d70fcb96ac	Fix warnings: signed/unisgned comparison, shadowing (in some cases global functions such as rand() ).	2011-03-12 17:27:03 +00:00
Ben Laurie	edc032b5e3	Add SRP support.	2011-03-12 17:01:19 +00:00
Ben Laurie	0c4e67102e	Fix warning.	2011-03-12 13:55:24 +00:00
Dr. Stephen Henson	329c744f51	make no-dsa work again	2011-03-10 18:26:50 +00:00
Dr. Stephen Henson	61f477f4ab	Fix duplicate code and typo.	2011-02-06 00:51:05 +00:00
Bodo Möller	9d0397e977	make update	2011-02-03 10:17:53 +00:00
Ben Laurie	105d62cbf1	Constify.	2011-01-09 17:50:18 +00:00
Richard Levitte	c596b2ab5b	Part of the IF structure didn't get pasted here... PR: 2393	2010-12-14 21:44:31 +00:00
Richard Levitte	b7ef916c38	First attempt at adding the possibility to set the pointer size for the builds on VMS. PR: 2393	2010-12-14 19:19:04 +00:00
Andy Polyakov	de3bb266f4	apps/x590.c: harmonize usage of STDout and out_err. PR: 2323	2010-12-12 10:52:56 +00:00
Dr. Stephen Henson	91f0828c95	fix no SIGALRM case in speed.c	2010-11-18 13:22:53 +00:00
Dr. Stephen Henson	f7d2f17a07	add TLS v1.1 options to s_server	2010-11-16 14:16:00 +00:00
Dr. Stephen Henson	838ea7f824	PR: 2366 Submitted by: Damien Miller <djm@mindrot.org> Reviewed by: steve Stop pkeyutl crashing if some arguments are missing. Also make str2fmt tolerate NULL parameter.	2010-11-11 14:42:50 +00:00
Ben Laurie	bf48836c7c	Fixes to NPN from Adam Langley.	2010-09-05 17:14:01 +00:00
Bodo Möller	7c2d4fee25	For better forward-security support, add functions SSL_[CTX_]set_not_resumable_session_callback. Submitted by: Emilia Kasper (Google) [A part of this change affecting ssl/s3_lib.c was accidentally commited separately, together with a compilation fix for that file; see s3_lib.c CVS revision 1.133 (http://cvs.openssl.org/chngview?cn=19855).]	2010-08-26 15:15:47 +00:00
Ben Laurie	ee2ffc2794	Add Next Protocol Negotiation.	2010-07-28 10:06:55 +00:00
Ben Laurie	3c530fef67	Sign mismatch.	2010-07-27 16:57:05 +00:00
Andy Polyakov	6acb4ff389	gcm128.c: API modification and readability improvements, add ghash benchmark to apps/speed.c.	2010-07-09 14:10:51 +00:00
Dr. Stephen Henson	dc53a037b0	i variable is used on some platforms	2010-07-05 11:05:24 +00:00
Ben Laurie	c8bbd98a2b	Fix warnings.	2010-06-12 14:13:23 +00:00
Dr. Stephen Henson	4e96633ac7	PR: 2262 Submitted By: Victor Wagner <vitus@cryptocom.ru> Fix error reporting in load_key function.	2010-05-27 14:09:03 +00:00
Dr. Stephen Henson	acf635b9b2	oops, revert test patch	2010-05-15 00:35:39 +00:00
Dr. Stephen Henson	19674b5a1d	PR: 2253 Submitted By: Ger Hobbelt <ger@hobbelt.com> Check callback return value when outputting errors.	2010-05-15 00:34:06 +00:00
Dr. Stephen Henson	00a37b5a9b	PR: 2220 Fixes to make OpenSSL compile with no-rc4	2010-04-06 11:18:59 +00:00
Dr. Stephen Henson	624fbfcadb	free up sigopts STACK	2010-03-14 13:09:00 +00:00
Dr. Stephen Henson	510777f2fc	clear bogus errors in ca utility	2010-03-14 13:07:48 +00:00
Dr. Stephen Henson	4c623cddbe	add -sigopt option to ca utility	2010-03-14 12:54:45 +00:00
Dr. Stephen Henson	cdb182b55a	new sigopt and PSS support for req and x509 utilities	2010-03-12 14:41:00 +00:00
Dr. Stephen Henson	77163b6234	don't leave bogus errors in the queue	2010-03-10 13:48:09 +00:00
Dr. Stephen Henson	bea29921a8	oops	2010-03-07 16:41:54 +00:00
Dr. Stephen Henson	7ed485bc9f	The OID sanity check was incorrect. It should only disallow leading 0x80 values.	2010-03-07 16:40:05 +00:00
Dr. Stephen Henson	bb845ee044	Add -engine_impl option to dgst which will use an implementation of an algorithm from the supplied engine instead of just the default one.	2010-03-05 13:28:21 +00:00
Dr. Stephen Henson	ebaa2cf5b2	PR: 2183 PR#1999 broke fork detection by assuming HAVE_FORK was set for all platforms. Include original HAVE_FORK detection logic while allowing it to be overridden on specific platforms with -DHAVE_FORK=1 or -DHAVE_FORK=0	2010-03-03 19:56:34 +00:00
Dr. Stephen Henson	a05b8d0ede	use supplied ENGINE in genrsa	2010-03-01 14:22:21 +00:00
Dr. Stephen Henson	40c5eaeeec	oops, revert verify.c change	2010-02-27 23:03:26 +00:00
Dr. Stephen Henson	c1ca9d3238	Add Kerberos fix which was in 0.9.8-stable but never committed to HEAD and 1.0.0. Original fix was on 2007-Mar-09 and had the log message: "Fix kerberos ciphersuite bugs introduced with PR:1336."	2010-02-27 23:02:41 +00:00
Dr. Stephen Henson	48435b2098	include TVS 1.1 version string	2010-02-26 19:38:33 +00:00
Dr. Stephen Henson	db28aa86e0	add -trusted_first option and verify flag	2010-02-25 12:21:48 +00:00
Dr. Stephen Henson	04e4b82726	allow setting of verify names in command line utilities and print out verify names in verify utility	2010-02-25 00:11:32 +00:00
Dr. Stephen Henson	5a9e3f05ff	PR: 2170 Submitted by: Magnus Lilja <lilja.magnus@gmail.com> Make -c option in dgst work again.	2010-02-12 17:07:16 +00:00
Dr. Stephen Henson	17ebc10ffa	PR: 2161 Submitted by: Doug Goldstein <cardoe@gentoo.org>, Steve. Make no-dsa, no-ecdsa and no-rsa compile again.	2010-02-02 13:35:27 +00:00
Dr. Stephen Henson	08c239701b	Experimental renegotiation support in s_server test -www server.	2010-01-28 19:48:36 +00:00
Dr. Stephen Henson	c2963f5b87	revert wrongly committed test code	2010-01-27 17:49:33 +00:00
Dr. Stephen Henson	4ba1aa393b	typo	2010-01-27 14:05:39 +00:00
Richard Levitte	407a410136	Have the VMS build system catch up with the 1.0.0-stable branch.	2010-01-27 09:18:42 +00:00
Dr. Stephen Henson	ba64ae6cd1	Tolerate PKCS#8 DSA format with negative private key.	2010-01-22 20:17:12 +00:00
Andy Polyakov	d582c98d8f	apps/speed.c: limit loop counters to 2^31 in order to avoid overflows in performance calculations. For the moment there is only one code fast enough to suffer from this: Intel AES-NI engine. PR: 2096	2010-01-17 17:31:38 +00:00
Dr. Stephen Henson	0e0c6821fa	PR: 2136 Submitted by: Willy Weisz <weisz@vcpc.univie.ac.at> Add options to output hash using older algorithm compatible with OpenSSL versions before 1.0.0	2010-01-12 17:29:34 +00:00
Andy Polyakov	cba9ffc32a	Fix compilation on older Linux. Linux didn't always have sockaddr_storage, not to mention that first sockaddr_storage had __ss_family, not ss_family. In other words it makes more sense to avoid sockaddr_storage...	2010-01-06 21:22:56 +00:00
Dr. Stephen Henson	35b0ea4efe	Add simple external session cache to s_server. This serialises sessions just like a "real" server making it easier to trace any problems.	2009-12-27 23:24:45 +00:00
Dr. Stephen Henson	ef51b4b9b4	New option to enable/disable connection to unpatched servers	2009-12-16 20:25:59 +00:00
Dr. Stephen Henson	5430200b8b	Add ctrl and macro so we can determine if peer support secure renegotiation.	2009-12-08 13:42:08 +00:00
Dr. Stephen Henson	637f374ad4	Initial experimental TLSv1.1 support	2009-12-07 13:31:02 +00:00
Dr. Stephen Henson	3533ab1fee	Replace the broken SPKAC certification with the correct version.	2009-12-02 14:41:51 +00:00
Dr. Stephen Henson	d2a53c2238	Experimental CMS password based recipient Info support.	2009-11-26 18:57:39 +00:00
Richard Levitte	0a02d1db34	Update from 1.0.0-stable	2009-11-12 17:03:10 +00:00
Dr. Stephen Henson	860c3dd1b6	add missing parts of reneg port, fix apps patch	2009-11-11 14:51:19 +00:00
Dr. Stephen Henson	2942dde56c	commit missing apps code for reneg fix	2009-11-11 14:10:24 +00:00
Dr. Stephen Henson	2008e714f3	Add missing functions to allow access to newer X509_STORE_CTX status information. Add more informative message to verify callback to indicate when CRL path validation is taking place.	2009-10-31 19:22:18 +00:00
Dr. Stephen Henson	245d2ee3d0	Add option to allow in-band CRL loading in verify utility. Add function load_crls and tidy up load_certs. Remove useless purpose variable from verify utility: now done with args_verify.	2009-10-31 13:33:57 +00:00
Dr. Stephen Henson	d4be92896c	Add -no_cache option to s_server	2009-10-28 17:49:30 +00:00
Dr. Stephen Henson	6aa1770c6d	Use new X509_STORE_set_verify_cb function instead of old macro.	2009-10-18 14:40:33 +00:00
Dr. Stephen Henson	be45636661	Fix for WIN32 and possibly other platforms which don't define in_port_t.	2009-10-15 18:49:30 +00:00
Dr. Stephen Henson	636b6b450d	PR: 2069 Submitted by: Michael Tuexen <tuexen@fh-muenster.de> Approved by: steve@openssl.org IPv6 support for DTLS.	2009-10-15 17:41:31 +00:00
Dr. Stephen Henson	2c55c0d367	PR: 1847 Submitted by: Tomas Mraz <tmraz@redhat.com> Approved by: steve@openssl.org Integrated patches to CA.sh to bring it into line with CA.pl functionality.	2009-10-15 17:27:34 +00:00
Dr. Stephen Henson	0431941ec5	Revert extra changes from previous commit.	2009-10-15 17:17:45 +00:00
Dr. Stephen Henson	42733b3bea	PR: 2066 Submitted by: Guenter <lists@gknw.net> Approved by: steve@openssl.org Add -r option to dgst to produce format compatible with core utilities.	2009-10-15 17:13:54 +00:00
Dr. Stephen Henson	0e039aa797	Fix warnings about ignoring fgets return value	2009-10-04 16:42:56 +00:00
Dr. Stephen Henson	b48315d9b6	PR: 2061 Submitted by: Julia Lawall <julia@diku.dk> Approved by: steve@openssl.org Correct i2b_PVK_bio error handling in rsa.c, dsa.c	2009-10-01 00:25:24 +00:00
Dr. Stephen Henson	18e503f30f	PR: 2064, 728 Submitted by: steve@openssl.org Add support for custom headers in OCSP requests.	2009-09-30 21:40:55 +00:00
Dr. Stephen Henson	37fc562bd8	Free SSL_CTX after BIO	2009-09-30 21:36:17 +00:00
Dr. Stephen Henson	a25f33d28a	Submitted by: Julia Lawall <julia@diku.dk> The functions ENGINE_ctrl(), OPENSSL_isservice(), EVP_PKEY_sign(), CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error fix so the return code is checked correctly.	2009-09-13 11:29:29 +00:00
Dr. Stephen Henson	08882ac5be	PR: 2038 Submitted by: Artem Chuprina <ran@cryptocom.ru> Approved by: steve@openssl.org Avoid double call to BIO_free().	2009-09-11 11:02:52 +00:00
Dr. Stephen Henson	b5ca7df5aa	PR: 2031 Submitted by: steve@openssl.org Tolerate application/timestamp-response which some servers send out.	2009-09-07 17:57:18 +00:00
Dr. Stephen Henson	e0d4e97c1a	Make update, deleting bogus DTLS error code	2009-09-06 15:58:19 +00:00
Dr. Stephen Henson	f4274da164	PR: 1644 Submitted by: steve@openssl.org Fix to make DHparams_dup() et al work in C++. For 1.0 fix the final argument to ASN1_dup() so it is void . Replace some _dup macros with functions.	2009-09-06 15:49:46 +00:00
Dr. Stephen Henson	07a9d1a2c2	PR: 2028 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org Fix DTLS cookie management bugs.	2009-09-04 17:42:53 +00:00
Dr. Stephen Henson	2d1cbca960	PR: 2020 Submitted by: Keith Beckman <kbeckman@mcg.edu>, Tomas Mraz <tmraz@redhat.com> Checked by: steve@openssl.org Fix improperly capitalized references to WWW::Curl::Easy.	2009-09-02 15:57:24 +00:00
Dr. Stephen Henson	17b5326ba9	PR: 2013 Submitted by: steve@openssl.org Include a flag ASN1_STRING_FLAG_MSTRING when a multi string type is created. This makes it possible to tell if the underlying type is UTCTime, GeneralizedTime or Time when the structure is reused and X509_time_adj_ex() can handle each case in an appropriate manner. Add error checking to CRL generation in ca utility when nextUpdate is being set.	2009-09-02 13:54:50 +00:00
Dr. Stephen Henson	1771668096	Tidy up and fix verify callbacks to avoid structure dereference, use of obsolete functions and enhance to handle new conditions such as policy printing.	2009-09-02 12:47:28 +00:00
Dr. Stephen Henson	ba4526e071	Stop unused variable warning on WIN32 et al.	2009-08-18 11:15:33 +00:00
Dr. Stephen Henson	3ed3603b60	Update default dependency flags. Make error name discrepancies a fatal error. Fix error codes. make update	2009-08-12 17:30:37 +00:00
Dr. Stephen Henson	b972fbaa8f	PR: 1997 Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org DTLS timeout handling fix.	2009-08-12 13:19:54 +00:00
Dr. Stephen Henson	77c7f17a5e	Typo	2009-08-10 15:52:49 +00:00
Dr. Stephen Henson	b318cfb169	PR: 1999 Submitted by: "Bayram Kurumahmut" <kbayram@ubicom.com> Approved by: steve@openssl.org Don't use HAVE_FORK in apps/speed.c it can conflict with configured version.	2009-08-10 15:30:40 +00:00
Dr. Stephen Henson	f10f4447da	Update from 1.0.0-stable.	2009-08-05 15:29:58 +00:00
Dr. Stephen Henson	c869da8839	Update from 1.0.0-stable	2009-07-27 21:10:00 +00:00
Dr. Stephen Henson	bdfa4ff947	Update from 0.9.8-stable	2009-07-24 11:17:10 +00:00
Dr. Stephen Henson	3f7c592082	Updates from 1.0.0-stable.	2009-07-14 15:30:05 +00:00
Dr. Stephen Henson	6053ef80e5	Use new time routines to avoid possible overflow.	2009-07-13 11:40:14 +00:00
Dr. Stephen Henson	c55d27ac33	Make update.	2009-07-08 09:19:53 +00:00
Dr. Stephen Henson	db99779bee	Use common verify parameters instead of the small ad-hoc subset in s_client, s_server.	2009-06-30 15:56:35 +00:00
Dr. Stephen Henson	e5b2b0f91f	Updates from 1.0.0-stable	2009-06-30 15:28:16 +00:00
Dr. Stephen Henson	9a5faeaa42	Allow setting of verify depth in verify parameters (as opposed to the depth implemented using the verify callback).	2009-06-29 16:09:37 +00:00
Dr. Stephen Henson	f3be6c7b7d	Update from 1.0.0-stable.	2009-06-26 11:29:26 +00:00
Dr. Stephen Henson	c05353c50a	Rename asc2uni and uni2asc functions to avoid clashes.	2009-06-17 12:04:56 +00:00
Dr. Stephen Henson	eddee61671	PR: 1956 Submitted by: Guenter <lists@gknw.net> Approved by: steve@openssl.org Netware doesn't have strings.h	2009-06-17 11:32:59 +00:00
Dr. Stephen Henson	58f41a926a	Updates from 1.0.0-stable	2009-06-05 14:59:26 +00:00
Dr. Stephen Henson	046f210112	Update from 1.0.0-stable.	2009-05-17 16:04:58 +00:00
Richard Levitte	cc8cc9a3a1	Functional VMS changes submitted by sms@antinode.info (Steven M. Schweda). Thank you\! (note: not tested for now, a few nightly builds should give indications though)	2009-05-15 16:36:56 +00:00
Dr. Stephen Henson	83d8fa7dd1	Update from stable branch.	2009-05-13 11:32:46 +00:00
Dr. Stephen Henson	d4f0339c66	Update from 1.0.0-stable.	2009-04-26 22:18:22 +00:00
Richard Levitte	7184ef1210	Cast to avoid signedness confusion	2009-04-26 12:16:08 +00:00
Dr. Stephen Henson	ef236ec3b2	Merge from 1.0.0-stable branch.	2009-04-23 16:32:42 +00:00
Dr. Stephen Henson	8711efb498	Updates from 1.0.0-stable branch.	2009-04-20 11:33:12 +00:00
Dr. Stephen Henson	e5fa864f62	Updates from 1.0.0-stable.	2009-04-15 15:27:03 +00:00
Dr. Stephen Henson	645532b999	Update from 1.0.0-stable	2009-04-06 21:42:37 +00:00
Dr. Stephen Henson	06ddf8eb08	Updates from 1.0.0-stable	2009-04-04 19:54:06 +00:00
Dr. Stephen Henson	14023fe352	Merge from 1.0.0-stable branch.	2009-04-03 11:45:19 +00:00
Dr. Stephen Henson	b6b0b0d7a5	Update from 1.0.0-stable.	2009-04-01 14:59:49 +00:00
Dr. Stephen Henson	70b2186e24	Stop warnings.	2009-03-31 19:54:51 +00:00
Dr. Stephen Henson	aaf35f11d7	Allow use of algorithm and cipher names for dgsts and enc utilities instead of having to manually include each one.	2009-03-30 11:31:50 +00:00
Dr. Stephen Henson	38b6e6c07b	Typo in usage message.	2009-03-23 21:04:23 +00:00
Dr. Stephen Henson	e4e949192b	Submitted by: Victor B. Wagner <vitus@cryptocom.ru> Reviewed by: steve@openssl.org Check return codes properly in md BIO and dgst command.	2009-03-18 18:53:08 +00:00
Dr. Stephen Henson	617298dca3	Update from stable branch.	2009-03-12 17:10:26 +00:00
Dr. Stephen Henson	33ab2e31f3	PR: 1854 Submitted by: Oliver Martin <oliver@volatilevoid.net> Reviewed by: steve@openssl.org Support GeneralizedTime in ca utility.	2009-03-09 13:59:07 +00:00
Ben Laurie	73bfcf2226	Don't ask for -iv for ciphers that need no IV.	2009-03-03 15:14:33 +00:00
Dr. Stephen Henson	0ed6b52687	Stop warning about use of *printf() without a format.	2009-02-15 15:29:59 +00:00
Dr. Stephen Henson	30b1b28aff	Return correct exit code.	2009-02-12 18:06:11 +00:00
Dr. Stephen Henson	46400c97a9	Avoid leaks in pkcs8 app, tidy code up.	2009-02-12 18:02:47 +00:00
Dr. Stephen Henson	3859d7ee78	Just to be awkward Ubuntu 8.10 doesn't like _XOPEN_SOURCE_EXTENDED...	2009-02-06 16:43:52 +00:00
Bodo Möller	d615bceb2d	For -hex, print just one \n	2009-02-02 00:40:29 +00:00
Bodo Möller	7ca1cfbac3	-hex option for openssl rand PR: 1831 Submitted by: Damien Miller	2009-02-02 00:01:28 +00:00
Richard Levitte	5871ddb016	Because DEC C - sorry, HP C - is picky about features, we need to define _XOPEN_SOURCE_EXTENDED to reach fd_set and timeval types and functionality.	2009-01-28 07:38:14 +00:00
Dr. Stephen Henson	bab534057b	Updatde from stable branch.	2009-01-07 23:44:27 +00:00
Ben Laurie	0eab41fb78	If we're going to return errors (no matter how stupid), then we should test for them!	2008-12-29 16:11:58 +00:00
Andy Polyakov	2140659b00	Incidentally http://cvs.openssl.org/chngview?cn=17710 also made it possible to build the library without -D_CRT_NONSTDC_NO_DEPRECATE. This commit expands it even to apps catalog and actually omits the macro in question from Configure.	2008-12-22 14:05:42 +00:00
Dr. Stephen Henson	70531c147c	Make no-engine work again.	2008-12-20 17:04:40 +00:00
Lutz Jänicke	d88d941c87	apps/speed.c: children should not inherit buffered I/O PR: 1787 Submitted by: Artur Klauser <aklauser@google.com>	2008-12-10 08:03:47 +00:00
Bodo Möller	7a76219774	Implement Configure option pattern "experimental-foo" (specifically, "experimental-jpake").	2008-12-02 01:21:39 +00:00
Dr. Stephen Henson	2900fc8ae1	Don't stop -cipher from working.	2008-11-30 22:01:31 +00:00
Dr. Stephen Henson	79bd20fd17	Update from stable-branch.	2008-11-24 17:27:08 +00:00
Ben Laurie	f3b7bdadbc	Integrate J-PAKE and TLS-PSK. Increase PSK buffer size. Fix memory leaks.	2008-11-16 12:47:12 +00:00
Ben Laurie	774b2fe700	Aftermath of a clashing size_t fix (now only format changes).	2008-11-13 09:48:47 +00:00
Dr. Stephen Henson	ed551cddf7	Update from stable branch.	2008-11-12 17:28:18 +00:00
Geoff Thorpe	6343829a39	Revert the size_t modifications from HEAD that had led to more knock-on work than expected - they've been extracted into a patch series that can be completed elsewhere, or in a different branch, before merging back to HEAD.	2008-11-12 03:58:08 +00:00
Dr. Stephen Henson	2e5975285e	Update obsolete email address...	2008-11-05 18:39:08 +00:00
Dr. Stephen Henson	70d71f6185	Fix warnings: printf format mismatches on 64 bit platforms. Change assert to OPENSSL_assert(). Fix e_padlock prototype.	2008-11-02 15:41:30 +00:00
Dr. Stephen Henson	c76fd290be	Fix warnings about mismatched prototypes, undefined size_t and value computed not used.	2008-11-02 12:50:48 +00:00
Ben Laurie	4d6e1e4f29	size_tification.	2008-11-01 14:37:00 +00:00
Dr. Stephen Henson	e9eda23ae6	Fix warnings and various issues. C++ style comments. Signed/unsigned warning in apps.c Missing targets in jpake/Makefile	2008-10-27 12:02:52 +00:00
Ben Laurie	6caa4edd3e	Add JPAKE.	2008-10-26 18:40:52 +00:00
Dr. Stephen Henson	ac786241a2	Add support for -crlnumber option in crl utility.	2008-10-22 19:54:55 +00:00
Lutz Jänicke	020d67fb89	Allow detection of input EOF in quiet mode by adding -no_ign_eof option to s_client application. PR: #1761 Submitted by: David Woodhouse <dwmw2@infradead.org>	2008-10-22 06:46:14 +00:00
Lutz Jänicke	1581f82243	Add missing "-d" to option list of openssl version. Submitted by: Alex Chen <alex_chen@filemaker.com>	2008-10-20 12:53:36 +00:00
Dr. Stephen Henson	640b86cb24	Fix Warning...	2008-10-19 17:22:34 +00:00
Ben Laurie	d5bbead449	Add XMPP STARTTLS support.	2008-10-14 19:11:26 +00:00
Ben Laurie	babb379849	Type-checked (and modern C compliant) OBJ_bsearch.	2008-10-12 14:32:47 +00:00
Dr. Stephen Henson	87d3a0cd90	Experimental new date handling routines. These fix issues with X509_time_adj() and should avoid any OS date limitations such as the year 2038 bug.	2008-10-07 22:55:27 +00:00
Bodo Möller	1a489c9af1	From branch OpenSSL_0_9_8-stable: Allow soft-loading engines. Also, fix CHANGES (consistency with stable branch).	2008-09-15 20:41:24 +00:00
Dr. Stephen Henson	0702150f53	Make no-tlsext compile.	2008-09-03 12:29:57 +00:00
Dr. Stephen Henson	d43c4497ce	Initial support for delta CRLs. If "use deltas" flag is set attempt to find a delta CRL in addition to a full CRL. Check and search delta in addition to the base.	2008-09-01 15:15:16 +00:00
Dr. Stephen Henson	9d84d4ed5e	Initial support for CRL path validation. This supports distinct certificate and CRL signing keys.	2008-08-13 16:00:11 +00:00
Dr. Stephen Henson	002e66c0e8	Support for policy mappings extension. Delete X509_POLICY_REF code. Fix handling of invalid policy extensions to return the correct error. Add command line option to inhibit policy mappings.	2008-08-12 10:32:56 +00:00
Geoff Thorpe	4c3296960d	Remove the dual-callback scheme for numeric and pointer thread IDs, deprecate the original (numeric-only) scheme, and replace with the CRYPTO_THREADID object. This hides the platform-specifics and should reduce the possibility for programming errors (where failing to explicitly check both thread ID forms could create subtle, platform-specific bugs). Thanks to Bodo, for invaluable review and feedback.	2008-08-06 15:54:15 +00:00
Dr. Stephen Henson	5cbd203302	Initial support for alternative CRL issuing certificates. Allow inibit any policy flag to be set in apps.	2008-07-30 15:49:12 +00:00
Ralf S. Engelschall	6bcbac0abb	remove a doubled entry for '-binary' in the usage message	2008-07-27 15:51:35 +00:00
Dr. Stephen Henson	db50661fce	X509 verification fixes. Ignore self issued certificates when checking path length constraints. Duplicate OIDs in policy tree in case they are allocated. Use anyPolicy from certificate cache and not current tree level.	2008-07-13 14:25:36 +00:00
Dr. Stephen Henson	d4cdbab99b	Avoid warnings with -pedantic, specifically: Conversion between void * and function pointer. Value computed not used. Signed/unsigned argument.	2008-07-04 23:12:52 +00:00
Geoff Thorpe	5f834ab123	Revert my earlier CRYPTO_THREADID commit, I will commit a reworked version some time soon.	2008-07-03 19:59:25 +00:00
Dr. Stephen Henson	8528128b2a	Update from stable branch.	2008-06-26 23:27:31 +00:00
Ben Laurie	5ce278a77b	More type-checking.	2008-06-04 11:01:43 +00:00
Dr. Stephen Henson	59d2d48f64	Add support for client cert engine setting in s_client app. Add appropriate #ifdefs round client cert functions in headers.	2008-06-03 11:26:27 +00:00
Dr. Stephen Henson	c451bd828f	Avoid case in ca.c fix.	2008-06-02 12:10:06 +00:00
Dr. Stephen Henson	8ecfbedd85	Revert, doesn't fix warning :-(	2008-06-02 10:42:57 +00:00
Dr. Stephen Henson	c173fce4e2	Avoid cast with wrapper function.	2008-06-02 10:37:53 +00:00
Dr. Stephen Henson	c6ddacf7f8	Stop const mismatch warning.	2008-05-31 19:28:57 +00:00
Dr. Stephen Henson	ab3eafd5b5	Stop warning about extra ';' outside of function.	2008-05-31 19:17:25 +00:00
Dr. Stephen Henson	dd043cd501	Stop const mismatch warning in VC++.	2008-05-31 18:55:23 +00:00
Ben Laurie	3c1d6bbc92	LHASH revamp. make depend.	2008-05-26 11:24:29 +00:00
Lutz Jänicke	51e00db226	Document "openssl s_server" -crl_check* options Submitted by: Daniel Black <daniel.subs@internode.on.net>	2008-05-19 07:52:15 +00:00
Lutz Jänicke	a92ebf2290	Provide information about "openssl dgst" -hmac option.	2008-05-19 07:43:34 +00:00
Lutz Jänicke	f49c687507	Typo. (From 0.9.8-stable/S. Henson) PR: 1672	2008-05-19 06:21:05 +00:00
Dr. Stephen Henson	718f8f7a9e	Fix from stable branch.	2008-05-12 16:24:31 +00:00
Dr. Stephen Henson	4a954b56c9	Use "cont" consistently in cms-examples.pl Add a -certsout option to output any certificates in a message. Add test for example 4.11	2008-05-01 23:30:06 +00:00
Lutz Jänicke	44a877aa88	Fix incorrect return value in apps/apps.c:parse_yesno() PR: 1607 Submitted by: "Christophe MacÃ©" <mace.christophe@gmail.com>	2008-04-17 14:15:27 +00:00
Lutz Jänicke	6b6fe3d8e4	Correctly handle case of bad arguments supplied to rsautl PR: 1659	2008-04-17 13:36:13 +00:00
Lutz Jänicke	4c1a6e004a	Apply mingw patches as supplied by Roumen Petrov an Alon Bar-Lev PR: 1552 Submitted by: Roumen Petrov <openssl@roumenpetrov.info>, "Alon Bar-Lev" <alon.barlev@gmail.com>	2008-04-17 10:19:16 +00:00
Dr. Stephen Henson	a5db50d005	Revert argument swap change... oops CMS_uncompress() was consistent...	2008-04-11 23:23:18 +00:00
Dr. Stephen Henson	529d329ce1	Make CMS_uncompress() argument order consistent with other functions.	2008-04-11 17:34:13 +00:00
Richard Levitte	fc003bcecb	Synchronise with Unix build	2008-04-11 01:53:16 +00:00
Dr. Stephen Henson	e0fbd07309	Add additional parameter to CMS_final() to handle detached content.	2008-04-10 11:22:14 +00:00
Dr. Stephen Henson	7f50d9a4b0	Correct references to smime in cms app.	2008-04-09 22:09:45 +00:00
Dr. Stephen Henson	36309aa2be	Signed receipt generation code.	2008-03-28 19:43:16 +00:00
Dr. Stephen Henson	eb9d8d8cd4	Support for verification of signed receipts.	2008-03-28 13:15:39 +00:00
Geoff Thorpe	f7ccba3edf	There was a need to support thread ID types that couldn't be reliably cast to 'unsigned long' (ie. odd platforms/compilers), so a pointer-typed version was added but it required portable code to check both modes to determine equality. This commit maintains the availability of both thread ID types, but deprecates the type-specific accessor APIs that invoke the callbacks - instead a single type-independent API is used. This simplifies software that calls into this interface, and should also make it less error-prone - as forgetting to call and compare both thread ID accessors could have led to hard-to-debug/infrequent bugs (that might only affect certain platforms or thread implementations). As the CHANGES note says, there were corresponding deprecations and replacements in the thread-related functions for BN_BLINDING and ERR too.	2008-03-28 02:49:43 +00:00
Dr. Stephen Henson	f5e2354c9d	Add support for signed receipt request printout and generation.	2008-03-26 17:40:22 +00:00
Dr. Stephen Henson	f4cc56f494	Signed Receipt Request utility functions and option on CMS utility to print out receipt requests.	2008-03-26 13:10:21 +00:00
Dr. Stephen Henson	6205171362	Add support for CMS structure printing in cms utility.	2008-03-24 21:53:07 +00:00
Dr. Stephen Henson	fe591284be	Update dependencies.	2008-03-22 18:52:03 +00:00
Dr. Stephen Henson	054307e7ed	Allow alternate eContentType oids to be set in cms utility. Add id-ct-asciiTextWithCRLF OID. Give more meaninful error message is attempt to use key ID from a certificate without a key ID.	2008-03-19 19:34:30 +00:00
Dr. Stephen Henson	eeb9cdfc94	Add support for KEK decrypt in cms utility.	2008-03-19 18:39:51 +00:00
Dr. Stephen Henson	ab12438030	Add support for KEKRecipientInfo in cms application.	2008-03-19 13:53:52 +00:00
Dr. Stephen Henson	c220e58f9e	Make 3DES default cipher in cms utility.	2008-03-18 19:03:03 +00:00
Dr. Stephen Henson	e4f0e40eac	Various tidies/fixes: Make streaming support in cms cleaner. Note errors in various S/MIME functions if CMS_final() fails. Add streaming support for enveloped data.	2008-03-18 13:45:43 +00:00
Geoff Thorpe	1e26a8baed	Fix a variety of warnings generated by some elevated compiler-fascism, OPENSSL_NO_DEPRECATED, etc. Steve, please double-check the CMS stuff...	2008-03-16 21:05:46 +00:00
Dr. Stephen Henson	7c337e00d2	Fix some warnings.	2008-03-16 20:59:10 +00:00
Geoff Thorpe	7e8481afd1	Fix a nasty cast issue that my compiler was choking on.	2008-03-16 20:57:12 +00:00
Dr. Stephen Henson	4f1aa191b3	Initial support for enveloped data decrypt. Extent runex.pl to cover these examples. All RFC4134 examples can not be processed.	2008-03-15 23:21:33 +00:00
Dr. Stephen Henson	d9f5f07e28	Initial support for Encrypted Data type generation.	2008-03-14 23:30:56 +00:00
Dr. Stephen Henson	1021f9aa5e	Typos.	2008-03-14 19:38:44 +00:00
Dr. Stephen Henson	b820455c6e	Encrypted Data type processing. Add options to cms utility and run section 7 tests in RFC4134.	2008-03-14 13:21:48 +00:00
Dr. Stephen Henson	8931b30d84	And so it begins... Initial support for CMS. Add zlib compression BIO. Add AES key wrap implementation. Generalize S/MIME MIME code to support CMS and/or PKCS7.	2008-03-12 21:14:28 +00:00
Dr. Stephen Henson	52108cecc0	<strings.h> does not exist under WIN32.	2008-01-14 18:10:55 +00:00
Ben Laurie	f12797a447	Missing headers.	2008-01-12 11:22:31 +00:00
Andy Polyakov	637f90621d	Cygwin compatibility fix to apps/ocsp.c.	2008-01-05 21:32:29 +00:00
Dr. Stephen Henson	eef0c1f34c	Netware support. Submitted by: Guenter Knauf <eflash@gmx.net>	2008-01-03 22:43:04 +00:00
Dr. Stephen Henson	341e18b497	Handle non-SHA1 digests for certids in OCSP test responder.	2007-12-14 12:43:50 +00:00
Dr. Stephen Henson	cec2538ca9	Submitted by: Victor B. Wagner <vitus@cryptocom.ru>, steve Use default algorithms for OCSP request and response signing. New command line option to support other digest use for OCSP certificate IDs.	2007-12-04 12:41:28 +00:00
Bodo Möller	15bd07e923	fix typos Submitted by: Ernst G. Giessmann	2007-11-19 07:24:08 +00:00
Ben Laurie	fdf355878c	Fix buffer overflow.	2007-11-16 14:41:09 +00:00
Dr. Stephen Henson	0e1dba934f	1. Changes for s_client.c to make it return non-zero exit code in case of handshake failure 2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to make it recognize GOST certificates as EVP_PKT_SIGN\|EVP_PKT_EXCH (required for s3_srvr to accept GOST client certificates). 3. Changes to EVP - adding of function EVP_PKEY_CTX_get0_peerkey - Make function EVP_PKEY_derive_set_peerkey work for context with ENCRYPT operation, because we use peerkey field in the context to pass non-ephemeral secret key to GOST encrypt operation. - added EVP_PKEY_CTRL_SET_IV control command. It is really GOST-specific, but it is used in SSL code, so it has to go in some header file, available during libssl compilation 4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data 5. Include des.h if KSSL_DEBUG is defined into some libssl files, to make debugging output which depends on constants defined there, work and other KSSL_DEBUG output fixes 6. Declaration of real GOST ciphersuites, two authentication methods SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST 7. Implementation of these methods. 8. Support for sending unsolicited serverhello extension if GOST ciphersuite is selected. It is require for interoperability with CryptoPro CSP 3.0 and 3.6 and controlled by SSL_OP_CRYPTOPRO_TLSEXT_BUG constant. This constant is added to SSL_OP_ALL, because it does nothing, if non-GOST ciphersuite is selected, and all implementation of GOST include compatibility with CryptoPro. 9. Support for CertificateVerify message without length field. It is another CryptoPro bug, but support is made unconditional, because it does no harm for draft-conforming implementation. 10. In tls1_mac extra copy of stream mac context is no more done. When I've written currently commited code I haven't read EVP_DigestSignFinal manual carefully enough and haven't noticed that it does an internal digest ctx copying. This implementation was tested against 1. CryptoPro CSP 3.6 client and server 2. Cryptopro CSP 3.0 server	2007-10-26 12:06:36 +00:00
Dr. Stephen Henson	b7fcc08976	Typo.	2007-09-28 17:18:18 +00:00
Dr. Stephen Henson	67c8e7f414	Support for certificate status TLS extension.	2007-09-26 21:56:59 +00:00
Bodo Möller	86d4bc3aea	fix length parameter in SSL_set_tlsext_opaque_prf_input() calls	2007-09-23 11:08:59 +00:00
Bodo Möller	761772d7e1	Implement the Opaque PRF Input TLS extension (draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.	2007-09-21 06:54:24 +00:00
Ben Laurie	9311c4421a	Fix dependencies. Make depend.	2007-09-19 14:53:18 +00:00
Ben Laurie	e28eddc51f	Typo? Why did this work, anyway?	2007-09-08 15:58:51 +00:00
Dr. Stephen Henson	d82a612a90	Fix warning: print format option not compatible with size_t.	2007-09-07 13:34:46 +00:00
Dr. Stephen Henson	e7e8f4b333	Fix another warning.	2007-09-07 13:27:40 +00:00
Dr. Stephen Henson	014f62b649	Add usage message for -sess_out, -sess_in	2007-08-23 12:20:36 +00:00
Dr. Stephen Henson	d24a9c8f5a	Docs and usage messages for RFC4507bis support.	2007-08-23 11:34:48 +00:00
Dr. Stephen Henson	367eb1f125	Fix warning and make no-tlsext work.	2007-08-12 18:56:14 +00:00
Dr. Stephen Henson	710069c19e	Fix warnings.	2007-08-12 17:44:32 +00:00
Dr. Stephen Henson	6434abbfc6	RFC4507 (including RFC4507bis) TLS stateless session resumption support for OpenSSL.	2007-08-11 23:18:29 +00:00
Andy Polyakov	d6c764573c	Proper support for shared build under MacOS X.	2007-07-31 18:24:41 +00:00
Bodo Möller	f7b61702a0	document -S and -nopad options in usage information	2007-07-31 09:42:47 +00:00
Dr. Stephen Henson	8dbdf6314c	Typo.	2007-05-21 16:36:09 +00:00
Dr. Stephen Henson	9c54e18bf0	Fixes for dgst tool. Initialize md_name, sig_name properly. Return error code on failure. Keep output format consistent with previous versions. Also flush stdout after printing ACCEPT in s_server.	2007-05-21 15:53:30 +00:00
Dr. Stephen Henson	0f9e0abbee	Set len to buffer size.	2007-05-17 16:42:05 +00:00
Dr. Stephen Henson	e77dbf325f	Prepend signature name in dgst output.	2007-05-17 16:19:17 +00:00
Dr. Stephen Henson	f03620ea15	Use default md if none specified in dgst utility.	2007-05-17 12:55:03 +00:00
Dr. Stephen Henson	47b2e238e5	Use EVP_DigestVerify() in dgst.c if verifying.	2007-05-17 12:35:32 +00:00
Dr. Stephen Henson	ad35cdac74	PR: 1516 Revert change in 1516 because it breaks Windows build. Use a modified version of the headers from s_client.c which has used similar functionality without any problems.	2007-05-16 12:16:49 +00:00
Ben Laurie	69ab085290	More IGE speedup.	2007-05-13 15:14:38 +00:00
Ben Laurie	5f09d0ecc2	AES IGE mode speedup.	2007-05-13 12:57:59 +00:00
Dr. Stephen Henson	6217896145	Improve error detection when streaming S/MIME. Only use streaming when appropriate for detached data in smime utility.	2007-05-10 17:37:15 +00:00
Andy Polyakov	6ef18c21c9	Bug in apps/dgst.c.	2007-04-30 15:20:10 +00:00
Bodo Möller	96afc1cfd5	Add SEED encryption algorithm. PR: 1503 Submitted by: KISA Reviewed by: Bodo Moeller	2007-04-23 23:48:59 +00:00
Dr. Stephen Henson	9cfc8a9d5c	Update smime utility to support streaming for -encrypt and -sign -nodetach options. Add new streaming i2d (though strictly speaking it is BER format when streaming) and PEM functions. These all process content on the fly without storing it all in memory.	2007-04-13 01:06:41 +00:00
Dr. Stephen Henson	2022cfe07e	New -mac and -macopt options to dgst utility. Reimplement -hmac option in terms of new API.	2007-04-11 17:20:40 +00:00
Dr. Stephen Henson	d952c79a7b	New -sigopt option for dgst utility.	2007-04-08 12:47:18 +00:00
Ben Laurie	3dfb6b3353	Yet another resource leak. Coverity ID 123.	2007-04-07 13:20:09 +00:00
Ben Laurie	44907e6064	Free memory. Coverity ID 62.	2007-04-05 15:45:22 +00:00
Ben Laurie	231671b9ff	Resource leak.	2007-04-04 16:00:03 +00:00
Ben Laurie	313fce7b61	Don't free a NULL. Coverity ID 112.	2007-04-04 14:59:20 +00:00
Ben Laurie	309fa55bbb	Return an error if the serial number is badly formed. (Coverity ID 116).	2007-04-04 14:35:56 +00:00
Ben Laurie	4b8747e440	Die if serial number is invalid.	2007-04-04 13:41:33 +00:00
Richard Levitte	a1d915990b	Apply a more modern way to get the definition of select(), except for VMS. Submitted by Corinna Vinschen <vinschen@redhat.com>	2007-03-29 18:34:57 +00:00
Dr. Stephen Henson	9981a51e42	Stage 1 GOST ciphersuite support. Submitted by: ran@cryptocom.ru Reviewed by: steve@openssl.org	2007-03-23 17:04:05 +00:00
Lutz Jänicke	ee373e7f19	Fix problem with multi line responses in -starttls by using a buffering BIO and BIO_gets().	2007-02-22 17:39:47 +00:00
Lutz Jänicke	8d72476e2b	Extend SMTP and IMAP protocol handling to perform the required EHLO or CAPABILITY handshake before sending STARTTLS Submitted by: Goetz Babin-Ebell <goetz@shomitefo.de>	2007-02-21 18:20:41 +00:00
Dr. Stephen Henson	5d5ca32fa1	Updates from 0.9.8-stable branch.	2007-02-18 18:21:57 +00:00
Richard Levitte	85c6749216	Add STARTTLS support for IMAP and FTP. Submitted by Kees Cook <kees@outflux.net>	2007-02-16 18:12:16 +00:00
Dr. Stephen Henson	52cfa39716	Add -hmac option to dgst from 0.9.7 stable branch.	2007-02-08 19:07:43 +00:00
Nils Larsch	123b23fa95	fix return value of get_cert_chain() PR: 1441	2006-12-27 09:40:52 +00:00
Richard Levitte	8bbf6bcf17	Needed definition of _XOPEN_SOURCE_EXTENDED so DEC C on VMS will see the declarations of fd_set, select() and so on.	2006-12-25 10:54:14 +00:00
Nils Larsch	ec1edeb5fa	update pkcs12 help message + manpage PR: 1443 Submitted by: Artem Chuprina <ran@cryptocom.ru>	2006-12-21 20:36:15 +00:00
Nils Larsch	5dfe910023	properly initialize SSL context, check return value	2006-12-13 22:06:37 +00:00
Nils Larsch	10a10fb834	return 0 if 'noout' is used and no error has occurred PR: 1435 Submitted by: "Haridharan" <haridharan@gmail.com>	2006-12-05 20:09:25 +00:00
Nils Larsch	ae93dc13ab	add support for whirlpool in apps/speed PR: 1338 Submitted by: justin@soze.net	2006-12-01 21:42:55 +00:00
Nils Larsch	7806f3dd4b	replace macros with functions Submitted by: Tracy Camp <tracyx.e.camp@intel.com>	2006-11-29 20:54:57 +00:00
Ben Laurie	96ea4ae91c	Add RFC 3779 support.	2006-11-27 14:18:05 +00:00
Dr. Stephen Henson	5456583294	Don't add the TS EKU by default in openssl.cnf because it then makes certificates genereated by ca, CA.pl etc useless for anything else.	2006-11-07 14:27:55 +00:00
Nils Larsch	224328e404	fix warning	2006-11-06 20:10:44 +00:00
Andy Polyakov	5b50f99e1e	Further mingw build procedure updates.	2006-10-24 22:14:20 +00:00
Andy Polyakov	cbfb39d1be	Rudimentary support for cross-compiling.	2006-10-21 13:38:16 +00:00
Dr. Stephen Henson	347ed3b93c	Buffer size handling fix for enc. PR:1374	2006-09-22 17:14:22 +00:00
Dr. Stephen Henson	5d20c4fb35	Overhaul of by_dir code to handle dynamic loading of CRLs.	2006-09-17 17:16:28 +00:00
Richard Levitte	5776c3c4c6	According to documentation, including time.h declares select() on OpenVMS, and possibly more. Ref: http://h71000.www7.hp.com/doc/82final/6529/6529pro_019.html#r_select	2006-08-20 05:54:35 +00:00
Richard Levitte	0c3d346cb7	Correct warnings about signedness.	2006-08-20 05:18:12 +00:00
Dr. Stephen Henson	f6e7d01450	Support for multiple CRLs with same issuer name in X509_STORE. Modify verify logic to try to use an unexpired CRL if possible.	2006-07-25 17:39:38 +00:00
Dr. Stephen Henson	1aa44cc797	Avoid WIN32 warning.	2006-07-21 22:28:48 +00:00
Dr. Stephen Henson	37c8fd0eba	Avoid warnings.	2006-07-21 22:26:31 +00:00
Dr. Stephen Henson	b589427941	WIN32 fixes signed/unsigned issues and slightly socket semantics.	2006-07-17 18:52:51 +00:00
Dr. Stephen Henson	454dbbc593	Add -timeout option to ocsp utility.	2006-07-17 13:26:54 +00:00
Dr. Stephen Henson	f253a058d3	There is should be no need to rewind the input stream any more. For S/MIME multipart/signed type the signature is calculated on the fly. For other detached data forms the stream isn't used after the single pass to calculate signatures. For non-detached the data is stored in a memory BIO.	2006-07-13 20:29:55 +00:00
Dr. Stephen Henson	b3c6a33185	In genpkey, also look for algorithm string name in any supplied ENGINE.	2006-07-12 18:00:20 +00:00
Dr. Stephen Henson	105f6a6323	Update some usage messages.	2006-07-10 22:49:08 +00:00
Dr. Stephen Henson	5ba4bf35c5	New functions to enumerate digests and ciphers.	2006-07-09 00:53:45 +00:00
Bodo Möller	b166f13eb5	Call 'print_stuff' even if a handshake failed.	2006-06-15 19:00:34 +00:00
Bodo Möller	6a983d4287	Fix a bug recently introduced when updating this file to use the new keygen API: make sure that 'pkey_type' is actually visible to MAIN().	2006-06-14 01:16:22 +00:00
Bodo Möller	f3dea9a595	Camellia cipher, contributed by NTT Submitted by: Masashi Fujita Reviewed by: Bodo Moeller	2006-06-09 15:44:59 +00:00
Dr. Stephen Henson	01b8b3c7d2	Complete EVP_PKEY_ASN1_METHOD ENGINE support.	2006-06-05 11:52:46 +00:00
Dr. Stephen Henson	6f88c6a634	Add missing prototype. Extend engine utility to print public key algorithms.	2006-06-01 12:38:22 +00:00
Richard Levitte	0ed110b969	Because all object files are now in a file, we don't need to mention any of them on the linker command line. Besides, OBJECT_FILE now represents the last compiled file, and using it here only results in getting warnings about multiple definitions of the symbols in that file.	2006-06-01 10:24:47 +00:00
Dr. Stephen Henson	6657b9c73a	Fix warnings.	2006-05-26 13:27:58 +00:00
Dr. Stephen Henson	ba0d04a986	Update pkeyutl to use size_t for pkey functions.	2006-05-26 12:24:49 +00:00
Richard Levitte	3cb9eb30d3	Signed vs. unsigned conflict	2006-05-25 23:40:04 +00:00
Richard Levitte	e0b624e20e	There was a problem with too long command lines, so I rebuilt to make it work better.	2006-05-25 23:37:03 +00:00
Dr. Stephen Henson	c27309edcb	Allow any supported cipher to be used with smime -encrypt.	2006-05-25 16:53:52 +00:00
Dr. Stephen Henson	216e0d5b91	Fix smime -pk7out.	2006-05-22 13:37:16 +00:00
Dr. Stephen Henson	5531192151	Add -resign and -md options to smime command to support resigning an existing structure and using alternative digest for signing.	2006-05-18 23:44:44 +00:00
Dr. Stephen Henson	a6e7fcd140	Multiple signer support in smime application.	2006-05-18 12:41:28 +00:00
Dr. Stephen Henson	76cf3fcb43	Reformat smime.c utility.	2006-05-18 11:54:16 +00:00
Dr. Stephen Henson	121dd39f9f	New option to pkcs12 utility to set alternative MAC digest algorithm.	2006-05-17 18:46:22 +00:00
Dr. Stephen Henson	a263253545	Don't try to print PBE information if it can't be decoded.	2006-05-17 18:24:35 +00:00
Dr. Stephen Henson	8de916bcee	Oops...	2006-05-17 12:29:16 +00:00
Dr. Stephen Henson	1631d5f9b9	HMAC OIDs from RFC4231.	2006-05-17 12:27:45 +00:00
Dr. Stephen Henson	98c82b899e	Gather keygen options in req and only use them after all other options have been processed. This allows any ENGINE changing operations to be processed first (for example a config file).	2006-05-16 12:11:14 +00:00
Dr. Stephen Henson	fbf6643607	Bugfix: the NONE string for PBE algorithms wasn't working.	2006-05-15 13:23:15 +00:00
Dr. Stephen Henson	1bd06bd0c4	In interactive mode only config OpenSSL once.	2006-05-12 17:11:58 +00:00
Richard Levitte	98bf13c36b	make update	2006-05-12 15:31:28 +00:00
Dr. Stephen Henson	759d8ac6ee	Typo.	2006-05-12 00:27:39 +00:00
Dr. Stephen Henson	959e8dfe06	Update 'req' command to use new keygen API.	2006-05-11 21:39:00 +00:00
Dr. Stephen Henson	03919683f9	Add support for default public key digest type ctrl.	2006-05-07 17:09:39 +00:00
Ulf Möller	36e77b1059	Bug fix. PR: 1307 Submitted by: Oliver Tappe <zooey@hirschkaefer.de>	2006-05-01 18:49:26 +00:00
Dr. Stephen Henson	816c2b5a79	Fix from stable branch.	2006-04-28 00:30:49 +00:00
Dr. Stephen Henson	15f80eea31	Fix usage message for pkeyutl.	2006-04-26 15:42:29 +00:00
Dr. Stephen Henson	ee1d9ec019	Remove link between digests and signature algorithms. Use cross reference table in ASN1_item_sign(), ASN1_item_verify() to eliminate the need for algorithm specific code.	2006-04-19 17:05:59 +00:00
Dr. Stephen Henson	7bf7333d68	If we include winsock2.h then FD_SET wants an unsigned type for an fd.	2006-04-17 12:22:13 +00:00
Dr. Stephen Henson	b010b7c434	Use more flexible method of determining output length, by setting &outlen value of the passed output buffer is NULL. The old method of using EVP_PKEY_size(pkey) isn't flexible enough to cover all cases where the output length may depend on the operation or the parameters associated with it.	2006-04-15 18:50:56 +00:00
Richard Levitte	51aa7bd321	Got sick and tired of duplicating... Too error-prone (i.e. I forget to update both...)!	2006-04-14 19:56:28 +00:00
Dr. Stephen Henson	ffb1ac674c	Complete key derivation support.	2006-04-13 20:16:56 +00:00
Dr. Stephen Henson	3be34589e8	Update dependencies.	2006-04-13 13:00:45 +00:00
Dr. Stephen Henson	92511cff48	Change the option setting command line switch to "-pkeyopt" to avoid confusion with algorithm parameters.	2006-04-13 12:38:46 +00:00
Richard Levitte	7b82159865	Synchronise what what's happening with the Unix build	2006-04-13 09:59:52 +00:00
Ulf Möller	fb05e1cdf6	declare as in prototype Submitted by: Gisle Vanem	2006-04-12 19:24:45 +00:00
Dr. Stephen Henson	75ef718820	Support for DSA keygen, fix for genpkey.	2006-04-12 11:14:11 +00:00
Ulf Möller	4700aea951	Add BeOS support. PR: 1312 Submitted by: Oliver Tappe <zooey@hirschkaefer.de> Reviewed by: Ulf Moeller	2006-04-11 21:34:21 +00:00
Ulf Möller	9555339007	improve make dclean to remove files generated during build PR: 1308 Submitted by: Oliver Tappe <zooey@hirschkaefer.de> Reviewed by: Ulf Moeller	2006-04-11 20:05:23 +00:00
Dr. Stephen Henson	2fbe371f53	Fix parameter error messages.	2006-04-11 18:30:25 +00:00
Dr. Stephen Henson	15181d7811	Write parameters if -genparam option include.	2006-04-11 18:21:40 +00:00
Dr. Stephen Henson	1edba2110f	Add parameter generation option to genpkey.	2006-04-11 18:18:14 +00:00
Dr. Stephen Henson	f5cda4cbb1	Initial keygen support.	2006-04-11 13:28:52 +00:00
Richard Levitte	25dc89eb9b	Synchronise with the Unix build	2006-04-10 11:39:49 +00:00
Dr. Stephen Henson	4a3dc3c0e3	Add RSA ctrl for padding mode, add ctrl support in pkeyutl.	2006-04-09 12:42:09 +00:00
Dr. Stephen Henson	a2318e86bd	Fix typo. Add EVP_PKEY_CTX control function for later use by command line utilities.	2006-04-09 00:34:00 +00:00
Dr. Stephen Henson	a9164153d1	Reformat pkeyutl.c, add support for verify operation but nothing actually supports it (yet).	2006-04-08 22:25:47 +00:00
Dr. Stephen Henson	8795d38906	Update dependencies.	2006-04-08 13:04:31 +00:00
Dr. Stephen Henson	8cd44e3630	Implement encrypt/decrypt using RSA.	2006-04-08 13:02:04 +00:00
Dr. Stephen Henson	9e4d0f0be2	New utility 'pkeyutl' a general purpose version of 'rsautl'.	2006-04-07 19:33:28 +00:00
Dr. Stephen Henson	53ec8809cf	Add an explicit load_config() call so any added algorithms are visible.	2006-04-04 18:47:20 +00:00
Dr. Stephen Henson	0b33dac310	New function to retrieve ASN1 info on public key algorithms. New command line option to print out info.	2006-04-04 18:16:03 +00:00

... 9 10 11 12 13 ...

2108 commits