wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
7685 commits 20 branches 302 tags 153 MiB
Commit graph

1330 commits

Author SHA1 Message Date
Ben Laurie
4b9dcd821f Add IGE and biIGE modes. 2006-08-28 11:00:32 +00:00
Bodo Möller
ec67e3b7e4 always read in RAND_poll() if we can't use select because of a too 
large FD: it's non-blocking mode anyway
 2006-06-28 14:50:00 +00:00
Richard Levitte
8de95bc05b Use poll() when possible to gather Unix randomness entropy 2006-06-27 06:31:57 +00:00
Bodo Möller
aa17ab7e57 Put ECCdraft ciphersuites back into default build (but disabled 
unless specifically requested)
 2006-06-22 12:35:54 +00:00
Bodo Möller
35908bd040 Remove ECC ciphersuites from 0.9.8 branch (should use 0.9.9 branch) 2006-06-20 08:50:33 +00:00
Bodo Möller
0e73294e26 Disable invalid ciphersuites 2006-06-14 17:52:01 +00:00
Bodo Möller
6d2cd23f40 Thread-safety fixes 2006-06-14 08:51:41 +00:00
Bodo Möller
e18eef3d7a Camellia cipher, contributed by NTT 
Submitted by: Masashi Fujita
Reviewed by: Bodo Moeller
 2006-06-09 15:42:21 +00:00
Dr. Stephen Henson
b723a7b11b Don't check for padding bug if compression is negotiated. 
PR: 1204
 2006-05-07 12:27:48 +00:00
Dr. Stephen Henson
1c5dc844e7 Update for next dev version. 2006-05-04 13:08:35 +00:00
Dr. Stephen Henson
f871949efd Prepare for new release. 2006-05-04 12:46:42 +00:00
Dr. Stephen Henson
cbb0b734c7 If cipher list contains a match for an explicit ciphersuite only match that 
one suite.
 2006-04-15 00:22:34 +00:00
Bodo Möller
5586a71a6e clarification 2006-03-11 22:10:46 +00:00
Dr. Stephen Henson
217382d584 Handle manifest files for VC++ 
Submitted by: Austin Ziegler <halostatue@gmail.com>
 2006-01-15 13:46:20 +00:00
Bodo Möller
bc9320452c update TLS-ECC code 
Submitted by: Douglas Stebila
 2005-12-13 07:41:47 +00:00
Bodo Möller
23d43aae27 add missing entry (the corresponding code *is* in the 0.9.8 branch, 
and both the code and the CHANGES entry are in HEAD)
 2005-12-13 07:32:10 +00:00
Dr. Stephen Henson
7614f0e55e Various zlib related fixes and enhancements. 2005-12-05 13:34:56 +00:00
Dr. Stephen Henson
feef17fd88 Update from HEAD. 2005-11-20 13:26:57 +00:00
Dr. Stephen Henson
abb0c2bba4 Update VC++ build engine to include supported engine DLL builds. 2005-11-06 17:49:00 +00:00
Richard Levitte
d3afc92bc9 Document it 2005-11-01 07:53:43 +00:00
Bodo Möller
20f7053254 harmonize with 0.9.7-stable CHANGES 2005-10-26 19:26:15 +00:00
Mark J. Cox
802c014656 One time CAN->CVE change 2005-10-19 10:51:36 +00:00
Richard Levitte
860841794d Add in CHANGES for 0.9.7i. 2005-10-15 04:27:05 +00:00
Mark J. Cox
d8b408b1de Bump after tag 2005-10-11 10:21:22 +00:00
Mark J. Cox
64932f9e4a Add fixes for CAN-2005-2969 
Bump release ready for OpenSSL_0_9_8a tag
 2005-10-11 10:16:21 +00:00
Dr. Stephen Henson
0fce007b8e Add two extra verify flags functions. 2005-09-02 22:48:21 +00:00
Nils Larsch
3c0e39c539 Keep cipher lists sorted in the source instead of sorting them at 
runtime, thus removing the need for a lock. Add a test to ssltest
to verify that the cipher lists are sorted.
 2005-08-25 07:43:04 +00:00
Bodo Möller
19fddebf0e recent DH change does not avoid *all* possible small-subgroup attacks; 
let's be clear about that
 2005-08-23 06:55:45 +00:00
Ben Laurie
6086422193 Missed stuff. 2005-08-20 21:30:33 +00:00
Ben Laurie
9ddb11f11c Avoid weak subgroups in Diffie Hellman. 2005-08-20 18:35:53 +00:00
Andy Polyakov
98e986141b Windows CE update from HEAD. 2005-08-07 22:29:58 +00:00
Dr. Stephen Henson
222f224664 Initialize SSL_METHOD structures at compile time. This removes the need 
for locking code. The CRYPTO_LOCK_SSL_METHOD lock is now no longer used.
 2005-08-05 23:52:08 +00:00
Dr. Stephen Henson
1682e8fb12 Allow PKCS7_decrypt() to work if no cert supplied. 2005-08-04 22:10:05 +00:00
Richard Levitte
750cb3d248 Now that 0.9.8 has been tagged, it's time to move on. 2005-07-05 19:11:56 +00:00
Richard Levitte
f254b540b8 Time to release OpenSSL 0.9.8. 
The tag will be OpenSSL_0_9_8.
 2005-07-05 18:49:43 +00:00
Richard Levitte
1d01c9d43d Last additions to the release documentation. 2005-07-05 18:32:05 +00:00
Andy Polyakov
e32ea81876 Mention Win64 support in CHANGES and throw in building instructions. 2005-07-05 10:53:13 +00:00
Dr. Stephen Henson
09c1a425a9 Add utf8 options to ca utility. 
PR:1109
 2005-07-04 23:04:28 +00:00
Dr. Stephen Henson
ab95eac286 Typo. 2005-06-02 20:30:46 +00:00
Dr. Stephen Henson
1cd76233d1 Update CHANGES. 2005-06-02 20:09:43 +00:00
Geoff Thorpe
a4578a5413 Change the source and output paths for 'chil' and '4758cca' engines so that 
dynamic loading is consistent with respect to engine ids.
 2005-05-29 19:16:26 +00:00
Bodo Möller
e4106a4e24 make sure DSA signing exponentiations really are constant-time 2005-05-26 04:40:57 +00:00
Bodo Möller
91b17fbad4 Change wording for BN_mod_exp_mont_consttime() entry 2005-05-16 19:14:34 +00:00
Bodo Möller
46a643763d Implement fixed-window exponentiation to mitigate hyper-threading 
timing attacks.

BN_FLG_EXP_CONSTTIME requests this algorithm, and this done by default for
RSA/DSA/DH private key computations unless
RSA_FLAG_NO_EXP_CONSTTIME/DSA_FLAG_NO_EXP_CONSTTIME/
DH_FLAG_NO_EXP_CONSTTIME is set.

Submitted by: Matthew D Wood
Reviewed by: Bodo Moeller
 2005-05-16 01:43:31 +00:00
Dr. Stephen Henson
b6995add5c Make -CSP option work again in pkcs12 utility by checking for 
attribute in EVP_PKEY structure.
 2005-05-15 00:54:45 +00:00
Bodo Möller
c6c2e3135d Don't use the SSL 2.0 Client Hello format if SSL 2.0 is disabled 
with the SSL_OP_NO_SSLv2 option.
 2005-05-11 18:25:49 +00:00
Nils Larsch
8b15c74018 give EC_GROUP_new_by_nid a more meanigful name: 
EC_GROUP_new_by_nid -> EC_GROUP_new_by_curve_name
 2005-05-10 11:37:47 +00:00
Bodo Möller
0f4499360e give EC_GROUP_*_nid functions a more meaningful name 
EC_GROUP_get_nid -> EC_GROUP_get_curve_name
    EC_GROUP_set_nid -> EC_GROUP_set_curve_name
 2005-05-09 00:05:17 +00:00
Dr. Stephen Henson
05338b58ce Support for smime-type MIME parameter. 2005-05-01 12:46:57 +00:00
Dr. Stephen Henson
6ec8e63af6 Port BN_MONT_CTX_set_locked() from stable branch. 
The function rsa_eay_mont_helper() has been removed because it is no longer
needed after this change.
 2005-04-26 23:58:54 +00:00
Nils Larsch
800e400de5 some updates for the blinding code; summary: 
- possibility of re-creation of the blinding parameters after a
  fixed number of uses (suggested by Bodo)
- calculatition of the rsa::e in case it's absent and p and q
  are present (see bug report #785)
- improve the performance when if one rsa structure is shared by
  more than a thread (see bug report #555)
- fix the problem described in bug report #827
- hide the definition ot the BN_BLINDING structure in bn_blind.c
 2005-04-26 22:31:48 +00:00
Ben Laurie
36d16f8ee0 Add DTLS support. 2005-04-26 16:02:40 +00:00
Bodo Möller
aa16a28631 first step to melt down ChangeLog.0_9_7-stable_not-in-head :-) 2005-04-25 21:06:05 +00:00
Nils Larsch
ff22e913a3 - use BN_set_negative and BN_is_negative instead of BN_set_sign 
and BN_get_sign
- implement BN_set_negative as a function
- always use "#define BN_is_zero(a) ((a)->top == 0)"
 2005-04-22 20:02:44 +00:00
Dr. Stephen Henson
bc3cae7e7d Include error library value in C error source files instead of fixing up 
at runtime.
 2005-04-12 13:31:14 +00:00
Dr. Stephen Henson
0858b71b41 Make kerberos ciphersuite code work with newer header files 2005-04-09 23:55:55 +00:00
Richard Levitte
d9bfe4f97c Added restrictions on the use of proxy certificates, as they may pose 
a security threat on unexpecting applications.  Document and test.
 2005-04-09 16:07:12 +00:00
Nils Larsch
dc0ed30cfe add support for DER encoded private keys to SSL_CTX_use_PrivateKey_file() 
and SSL_use_PrivateKey_file()

PR: 1035
Submitted by: Walter Goulet
Reviewed by:  Nils Larsch
 2005-04-08 22:52:42 +00:00
Nils Larsch
6049399baf get rid of very buggy and very imcomplete DH cert support 
Reviewed by: Bodo Moeller
 2005-04-07 23:19:17 +00:00
Nils Larsch
12bdb64375 use SHA-1 as the default digest for the apps/openssl commands 2005-04-02 09:29:15 +00:00
Ben Laurie
41a15c4f0f Give everything prototypes (well, everything that's actually used). 2005-03-31 09:26:39 +00:00
Bodo Möller
b0ef321cc8 Harmonize with CHANGES as distributed in OpenSSL 0.9.7f. 2005-03-24 01:37:07 +00:00
Ulf Möller
7a8c728860 undo Cygwin change 2005-03-24 00:14:59 +00:00
Dr. Stephen Henson
59b6836ab2 Ensure (SSL_RANDOM_BYTES - 4) of pseudo random data is used for server and 
client random values.
 2005-03-22 14:11:06 +00:00
Ulf Möller
130db968b8 Use Windows randomness code on Cygwin 2005-03-19 11:39:17 +00:00
Bodo Möller
ecc5ef8793 In addition to RC5, also exclude MDC2 from compilation unless 
the algorithm is explicitly requested.
 2005-03-02 20:11:31 +00:00
Bodo Möller
c9a112f540 Change ./Configure so that certain algorithms can be disabled by default. 
This is now the case for RC5.

As a side effect, the OPTIONS in the Makefile will usually look a
little different now, but they are essentially only for information
anyway.
 2005-02-22 10:29:51 +00:00
Lutz Jänicke
f69a8aebab Fix hang in EGD/PRNGD query when communication socket is closed 
prematurely by EGD/PRNGD.
PR: 1014
Submitted by: Darren Tucker <dtucker@zip.com.au>
 2005-02-19 10:19:07 +00:00
Dr. Stephen Henson
e90faddaf8 Prompt for passphrases for PKCS12 input format 2004-12-29 01:07:14 +00:00
Richard Levitte
6951c23afd Add functionality needed to process proxy certificates. 2004-12-28 00:21:35 +00:00
Dr. Stephen Henson
a0e7c8eede Add lots of checks for memory allocation failure, error codes to indicate 
failure and freeing up memory if a failure occurs.

PR:620
 2004-12-05 01:03:15 +00:00
Dr. Stephen Henson
5b40d7dd97 Add -passin argument to dgst command. 2004-12-03 12:26:56 +00:00
Dr. Stephen Henson
1862dae862 Perform partial comparison of different character types in X509_NAME_cmp(). 2004-12-01 01:45:30 +00:00
Richard Levitte
5022e4ecdf Document the change. 2004-11-29 11:57:00 +00:00
Andy Polyakov
ea681ba872 Summarize recent RC4 tune-ups. 2004-11-26 15:26:09 +00:00
Dr. Stephen Henson
401ee37a3e Allow alternative manual sections to be embedded in .pod file comments. 2004-11-25 17:47:31 +00:00
Dr. Stephen Henson
826a42a088 PR: 910 
Add command line options -certform, -keyform and -pass to s_client and
s_server. This supports the use of alternative passphrase sources, key formats
and keys handled by an ENGINE.

Update docs.
 2004-11-16 17:30:59 +00:00
Dr. Stephen Henson
2f605e8d24 Fix race condition when CRL checking is enabled. 2004-10-04 16:30:12 +00:00
Dr. Stephen Henson
5d7c222db8 New X509_VERIFY_PARAM structure and associated functionality. 
This tidies up verify parameters and adds support for integrated policy
checking.

Add support for policy related command line options. Currently only in smime
application.

WARNING: experimental code subject to change.
 2004-09-06 18:43:01 +00:00
Geoff Thorpe
30fe028f07 Make a note of the new engine. 2004-08-04 22:42:29 +00:00
Dr. Stephen Henson
637ff35ef6 Delta CRL support in extension code. 2004-07-06 17:16:40 +00:00
Geoff Thorpe
df11e1e921 Deprecate unused cruft, and "make update". 2004-06-17 23:50:25 +00:00
Andy Polyakov
ad5003409d Mention new SHA algorithms in CHANGES. This completes the integration. 2004-05-31 14:03:02 +00:00
Dr. Stephen Henson
4843acc868 Fixes so alerts are sent properly in s3_pkt.c 
PR: 851
 2004-05-15 17:55:07 +00:00
Andy Polyakov
e14f4aab0a CHANGES to mention improved PowerPC platform support. 2004-05-13 13:58:44 +00:00
Bodo Möller
d5f686d808 - update from current 0.9.6-stable CHANGES file 
- update from current 0.9.7-stable CHANGES file:

  Now here we have "CHANGES between 0.9.7e and 0.9.8", and I hope
  that all patches mentioned for 0.9.7d and 0.9.7e actually are
  in the CVS HEAD, i.e. what is to become 0.9.8.

  I have rewritten the 'openssl ca -create_serial' entry (0.9.8)
  so that it explains the earlier change that is now listed (0.9.7e).

  The ENGINE_set_default typo bug entry has been moved from 0.9.8
  to 0.9.7b, which is where it belongs.
 2004-05-04 01:15:48 +00:00
Geoff Thorpe
bcfea9fb25 Allow RSA key-generation to specify an arbitrary public exponent. Jelte 
proposed the change and submitted the patch, I jiggled it slightly and
adjusted the other parts of openssl that were affected.

PR: 867
Submitted by: Jelte Jansen
Reviewed by: Geoff Thorpe
 2004-04-26 15:31:35 +00:00
Geoff Thorpe
955d465c2c As far as I can tell, the bugfix this comment refers to was committed to 
0.9.7-stable as well as HEAD (and doesn't apply to the 0.9.6-engine
variant).
 2004-04-21 15:12:20 +00:00
Dr. Stephen Henson
64674bcc8c Reduce chances of issuer and serial number duplication by use of random 
initial serial numbers.

PR: 842
 2004-04-20 12:05:26 +00:00
Geoff Thorpe
3a87a9b9db Reduce header interdependencies, initially in engine.h (the rest of the 
changes are the fallout). As this could break source code that doesn't
directly include headers for interfaces it uses, changes to recursive
includes are covered by the OPENSSL_NO_DEPRECATED symbol. It's better to
define this when building and using openssl, and then adapt code where
necessary - this is how to stay current. However the mechanism exists for
the lethargic.
 2004-04-19 17:46:04 +00:00
Dr. Stephen Henson
bf5773fa2d Oops forgot CHANGES entry. 2004-03-31 12:55:33 +00:00
Dr. Stephen Henson
216659eb87 Enhance EVP code to generate random symmetric keys of the 
appropriate form, for example correct DES parity.

Update S/MIME code and EVP_SealInit to use new functions.

PR: 700
 2004-03-28 17:38:00 +00:00
Dr. Stephen Henson
e1a27eb34a Allow CRLs to be passed into X509_STORE_CTX. This is useful when the 
verified structure can contain its own CRLs (such as PKCS#7 signedData).

Tidy up some of the verify code.
 2004-03-27 22:49:28 +00:00
Dr. Stephen Henson
6446e0c3c8 Extend OID config module format. 2004-03-27 13:30:14 +00:00
Geoff Thorpe
5c98b2caf5 Replace the BN_CTX implementation with my current work. I'm leaving the 
little TODO list in there as well as the debugging code (only enabled if
BN_CTX_DEBUG is defined).

I'd appreciate as much review and testing as can be spared for this. I'll
commit some changes to other parts of the bignum code shortly to make
better use of this implementation (no more fixed size limitations). Note
also that under identical optimisations, I'm seeing a noticable speed
increase over openssl-0.9.7 - so any feedback to confirm/deny this on other
systems would also be most welcome.
 2004-03-25 04:16:14 +00:00
Geoff Thorpe
46ef873f0b By adding a BN_CTX parameter to the 'rsa_mod_exp' callback, private key 
operations no longer require two distinct BN_CTX structures. This may put
more "strain" on the current BN_CTX implementation (which has a fixed limit
to the number of variables it will hold), but so far this limit is not
triggered by any of the tests pass and I will be changing BN_CTX in the
near future to avoid this problem anyway.

This also changes the default RSA implementation code to use the BN_CTX in
favour of initialising some of its variables locally in each function.
 2004-03-25 02:52:04 +00:00
Dr. Stephen Henson
4acc3e907d Initial support for certificate policy checking and evaluation. 
This is currently *very* experimental and needs to be more fully integrated
with the main verification code.
 2004-03-23 14:14:35 +00:00
Geoff Thorpe
7f663ce430 Note my bignum hijinx in case app maintainers are using CHANGES for their 
porting efforts. Also, add Richard's name to the prior change.
 2004-03-17 18:30:47 +00:00
Richard Levitte
875a644a90 Constify d2i, s2i, c2i and r2i functions and other associated 
functions and macros.

This change has associated tags: LEVITTE_before_const and
LEVITTE_after_const.  Those will be removed when this change has been
properly reviewed.
 2004-03-15 23:15:26 +00:00
Geoff Thorpe
b6358c89a1 Convert openssl code not to assume the deprecated form of BN_zero(). 
Remove certain redundant BN_zero() initialisations, because BN_CTX_get(),
BN_init(), [etc] already initialise to zero.

Correct error checking in bn_sqr.c, and be less wishy-wash about how/why
the result's 'top' value is set (note also, 'max' is always > 0 at this
point).
 2004-03-13 23:57:20 +00:00