wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
12341 commits 20 branches 302 tags 153 MiB
Commit graph

6304 commits

Author SHA1 Message Date
Andy Polyakov
a356e488ad x86_64 assembly pack: refine clang detection. 2014-06-28 17:23:21 +02:00
Andreas Westfeld
d1d4382dcb Fix typo in ideatest.c 2014-06-28 00:06:13 +01:00
Dr. Stephen Henson
59deb33cbe Fix for EVP_PBE_alg_add(). 
In EVP_PBE_alg_add don't use the underlying NID for the cipher
as it may have a non-standard key size.

PR#3206
 2014-06-27 23:19:39 +01:00
Andy Polyakov
406d4af050 bn/asm/rsaz-avx2.pl: fix occasional failures. 2014-06-27 22:41:58 +02:00
Dr. Stephen Henson
11da66f8b1 Tolerate critical AKID in CRLs. 
PR#3014
 2014-06-27 18:49:32 +01:00
Tom Greenslade
b36f35cda9 Handle IPv6 addresses in OCSP_parse_url. 
PR#2783
 2014-06-27 17:30:59 +01:00
Dr. Stephen Henson
abac8e0e08 Rebuild OID table. 2014-06-27 14:35:07 +01:00
Dr. Stephen Henson
95791bf941 Fix OID encoding for one component. 
OIDs with one component don't have an encoding.

PR#2556 (Bug#1)
 2014-06-27 14:35:07 +01:00
Dr. Stephen Henson
d2aea03829 Memory leak and NULL dereference fixes. 
PR#3403
 2014-06-27 14:35:07 +01:00
Huzaifa Sidhpurwala
3b3b69ab25 Make sure BN_sqr can never return a negative value. 
PR#3410
 2014-06-26 23:56:34 +01:00
Dr. Stephen Henson
7be6b27aaf Remove ancient obsolete files under pkcs7. 2014-06-26 23:56:34 +01:00
Andy Polyakov
f3f620e1e0 bn_exp.c: move check for AD*X to rsaz-avx2.pl. 
This ensures high performance is situations when assembler supports
AVX2, but not AD*X.
 2014-06-27 00:07:15 +02:00
Andy Polyakov
052ecf91d2 aesp8-ppc.pl: rigid input verification in key setup. 2014-06-25 22:13:17 +02:00
Andy Polyakov
7b8c8c4d79 aesv8-armx.pl: rigid input verification in key setup. 2014-06-25 22:10:45 +02:00
Andy Polyakov
7eb0488280 x86_64 assembly pack: addendum to last clang commit. 2014-06-24 08:37:05 +02:00
Andy Polyakov
ac171925ab x86_64 assembly pack: allow clang to compile AVX code. 2014-06-24 08:24:25 +02:00
Andy Polyakov
015364baf3 aesv8-armx.pl: inclrease interleave factor. 
This is to compensate for higher aes* instruction latency on Cortex-A57.
 2014-06-24 08:08:58 +02:00
Andy Polyakov
0f777aeb50 ARMv8 assembly pack: add Cortex performance numbers. 2014-06-24 08:06:05 +02:00
Viktor Dukhovni
eef1827f89 One more typo when changing !result to result <= 0 2014-06-23 16:26:34 +01:00
Viktor Dukhovni
90b70a6a6b Fix typo in last commit 2014-06-22 20:39:52 -04:00
Viktor Dukhovni
8abffa4a73 Multiple verifier reference identities. 
Implemented as STACK_OF(OPENSSL_STRING).
 2014-06-22 20:32:35 -04:00
Viktor Dukhovni
66d884f067 Implement sk_deep_copy. 2014-06-22 20:24:18 -04:00
Viktor Dukhovni
29edebe95c More complete input validation of X509_check_mumble 2014-06-22 20:18:53 -04:00
Viktor Dukhovni
a48fb0400c X509_check_mumble() failure is <= 0, not just 0 2014-06-22 20:14:53 -04:00
Viktor Dukhovni
b3012c698a Drop hostlen from X509_VERIFY_PARAM_ID. 
Just store NUL-terminated strings.  This works better when we add
support for multiple hostnames.
 2014-06-22 19:52:44 -04:00
Felix Laurie von Massenbach
50cc4f7b3d Fix signed/unsigned comparisons. 2014-06-17 17:41:46 +01:00
Felix Laurie von Massenbach
1f61d8b5b1 Fix shadow declaration. 2014-06-17 17:41:46 +01:00
Andy Polyakov
9024b84b7c aesni-sha[1|256]-x86_64.pl: fix logical error and MacOS X build. 2014-06-16 10:11:45 +02:00
Andy Polyakov
764fe518da aesp8-ppc.pl: add CTR mode. 2014-06-16 08:05:19 +02:00
Viktor Dukhovni
7241a4c7fd Enforce _X509_CHECK_FLAG_DOT_SUBDOMAINS internal-only 2014-06-14 22:31:29 +01:00
Andy Polyakov
ce00c64df9 evp/e_aes_cbc_sha[1|256].c: fix -DPEDANTIC build. 2014-06-14 23:15:39 +02:00
Andy Polyakov
91a6bf80f8 aesni-sha256-x86_64.pl: add missing rex in shaext. 
PR: 3405
 2014-06-14 16:03:06 +02:00
Andy Polyakov
c9cf29cca2 sha1-x86_64.pl: add missing rex prefix in shaext. 
PR: 3405
 2014-06-14 15:27:54 +02:00
Viktor Dukhovni
a09e4d24ad Client-side namecheck wildcards. 
A client reference identity of ".example.com" matches a server
certificate presented identity that is any sub-domain of "example.com"
(e.g. "www.sub.example.com).

With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches
only direct child sub-domains (e.g. "www.sub.example.com").
 2014-06-12 23:19:25 +01:00
Andy Polyakov
977f32e852 Facilitate back-porting of AESNI and SHA modules. 
Fix SEH and stack handling in Win64 build.
 2014-06-12 21:45:41 +02:00
Andy Polyakov
1cf8f57b43 ghash-x86_64.pl: optimize for upcoming Atom. 2014-06-11 11:34:18 +02:00
Andy Polyakov
619b94667c Add support for Intel SHA extension. 2014-06-11 10:27:45 +02:00
Rob Stradling
fd2309aa29 Separate the SCT List parser from the SCT List viewer 2014-06-10 23:44:13 +01:00
Andy Polyakov
e2eabed110 aesni-mb-x86_64.pl: add Win64 SEH. 2014-06-10 23:08:06 +02:00
Dr. Stephen Henson
7a9d59c148 Fix null pointer errors. 
PR#3394
 2014-06-10 14:47:29 +01:00
Jakub Wilk
7be1d8764d Create ~/.rnd with mode 0600 instead of 0666 
Because of a missing include <fcntl.h> we don't have O_CREATE and don't create
the file with open() using mode 0600 but fall back to using fopen() with the
default umask followed by a chmod().

Problem found by Jakub Wilk <jwilk@debian.org>.
 2014-06-08 21:15:48 +01:00
Andy Polyakov
5dcf70a1c5 ARM assembly pack: get ARMv7 instruction endianness right. 
Pointer out and suggested by: Ard Biesheuvel.
 2014-06-06 21:27:18 +02:00
Andy Polyakov
cd91fd7c32 sha[1|512]-armv8.pl: get instruction endianness right. 
Submitted by: Ard Biesheuvel.
 2014-06-06 20:50:43 +02:00
Andy Polyakov
82741e9c89 Engage GHASH for ARMv8. 2014-06-06 20:48:35 +02:00
Andy Polyakov
2d5a799d27 Add GHASH for ARMv8 Crypto Extension. 
Result of joint effort with Ard Biesheuvel.
 2014-06-06 20:43:02 +02:00
Andy Polyakov
65cad34b10 aesv8-armx.pl update: 
- fix 32-bit build (submitted by Ard Biesheuvel);
- fix performance issue in CTR;
 2014-06-06 12:18:51 +02:00
Andy Polyakov
d86689e1d9 aesp8-ppc.pl: fix typos. 2014-06-04 08:34:18 +02:00
Andy Polyakov
53a224bb0a evp/e_aes.c: add erroneously omitted break; 2014-06-04 08:33:06 +02:00
Libor Krystek
8e3231642b Corrected OPENSSL_NO_EC_NISTP_64_GCC_128 usage in ec_lcl.h. PR#3370 2014-06-03 23:15:58 +01:00
Andy Polyakov
030a3f9527 evp/e_aes.c: populate HWAES_* to remaning modes. 
Submitted by: Ard Biesheuvel.
 2014-06-02 21:48:02 +02:00
Andy Polyakov
de51e830a6 Engage POWER8 AES support. 2014-06-01 23:38:11 +02:00
Andy Polyakov
723463282f armv4cpuid.S: switch to CNTVCT tick counter. 2014-06-01 22:34:02 +02:00
Andy Polyakov
797d24bee9 sha[1|256]-armv4: harmonize with arm_arch.h. 2014-06-01 22:29:50 +02:00
Andy Polyakov
ddacb8f27b Engage ARMv8 AES support. 2014-06-01 22:20:37 +02:00
Andy Polyakov
f8aab6174c linux-aarch64: engage SHA modules. 2014-06-01 18:03:51 +02:00
Andy Polyakov
ddb6b965da Add SHA for ARMv8. 2014-06-01 18:02:11 +02:00
Andy Polyakov
e8d93e342b Add linux-aarch64 taget. 
armcap.c is shared between 32- and 64-bit builds and features link-time
detection of getauxval.

Submitted by: Ard Biesheuvel.
 2014-06-01 17:21:06 +02:00
Ben Laurie
c93233dbfd Tidy up, don't exceed the number of requested bits. 2014-06-01 15:31:27 +01:00
Ben Laurie
46838817c7 Constify and reduce coprime random bits to allow for multiplier. 2014-06-01 15:31:27 +01:00
Felix Laurie von Massenbach
8927c2786d Add a test to check we're really generating probable primes. 2014-06-01 15:31:27 +01:00
Felix Laurie von Massenbach
9a3a99748b Remove unused BIGNUMs. 2014-06-01 15:31:27 +01:00
Felix Laurie von Massenbach
c74e148776 Refactor the first prime index. 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
982c42cb20 Try skipping over the adding and just picking a new random number. 
Generates a number coprime to 2, 3, 5, 7, 11.

Speed:
Trial div (add) : trial div (retry) : coprime
1 : 0.42 : 0.84
 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
c09ec5d2a0 Generate safe primes not divisible by 3, 5 or 7. 
~2% speed improvement on trial division.
 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
b0513819e0 Add a method to generate a prime that is guaranteed not to be divisible by 3 or 5. 
Possibly some reduction in bias, but no speed gains.
 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
e46a059ebf Remove static from probable_prime_dh. 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
e55fca760b Remove indentation from the goto targets. 2014-06-01 15:31:26 +01:00
Dr. Stephen Henson
3009244da4 Set default global mask to UTF8 only. 2014-06-01 15:03:00 +01:00
Andy Polyakov
e09ea622bb aesv8-armx.pl: add CTR implementation. 
Submitted by: Ard Biesheuvel.
 2014-05-29 22:45:35 +02:00
Dr. Stephen Henson
46d889f33e Set version number correctly. 
PR#3249
 2014-05-29 14:33:32 +01:00
František Bořánek
4da0ddc47e Fix memory leak. 
PR#3278
 2014-05-29 14:33:32 +01:00
Martin Kaiser
1c4575ebc3 remove duplicate 0x for default RSASSA-PSS salt len 2014-05-29 14:33:32 +01:00
Andy Polyakov
7cbdb975c2 aesp8-ppc.pl: optimize CBC decrypt even further. 
10-19% improvement depending on key length and endianness.
 2014-05-29 15:10:12 +02:00
Ben Laurie
ba4477d649 Make it build. 
Closes #31.
 2014-05-25 17:35:04 +01:00
Christian Heimes
56431240ae add test case to makefiles 2014-05-25 17:35:04 +01:00
Christian Heimes
4d4a535dcf Implement tests for PKCS#5 PBKDF2 HMAC 2014-05-25 17:35:04 +01:00
Dr. Stephen Henson
0930251df8 Don't use expired certificates if possible. 
When looking for the issuer of a certificate, if current candidate is
expired, continue looking. Only return an expired certificate if no valid
certificates are found.

PR#3359
 2014-05-25 04:50:15 +01:00
Dr. Stephen Henson
6c21b860ba Rename vpm_int.h to x509_lcl.h 2014-05-25 04:50:14 +01:00
Luiz Angelo Daros de Luca
dd36fce023 OpenSSL is able to generate a certificate with name constraints with any possible 
subjectAltName field. The Name Contraint example in x509v3_config(5) even use IP
as an example:

	nameConstraints=permitted;IP:192.168.0.0/255.255.0.0

However, until now, the verify code for IP name contraints did not exist. Any
check with a IP Address Name Constraint results in a "unsupported name constraint
type" error.

This patch implements support for IP Address Name Constraint (v4 and v6). This code
validaded correcly certificates with multiple IPv4/IPv6 address checking against
a CA certificate with these constraints:

	permitted;IP.1=10.9.0.0/255.255.0.0
	permitted;IP.2=10.48.0.0/255.255.0.0
	permitted;IP.3=10.148.0.0/255.255.0.0
	permitted;IP.4=fdc8:123f:e31f::/ffff:ffff:ffff::

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
 2014-05-23 23:05:38 +01:00
Andy Polyakov
fda29b6db0 aesp8-ppc.pl: add optimized CBC decrypt. 2014-05-23 20:15:06 +02:00
Andy Polyakov
b83d09f552 vpaes-ppc.pl: comply with ABI. 2014-05-23 20:14:38 +02:00
Ben Laurie
eb33348879 Check length first in BUF_strnlen(). 2014-05-22 10:13:22 +01:00
Ben Laurie
12f1b3e79f Remove redundant test. 2014-05-21 12:03:02 +01:00
Ben Laurie
dea4a18404 Implement BUF_strnlen() and use it instead of strlen(). 2014-05-21 11:58:03 +01:00
Viktor Dukhovni
397a8e747d Fixes to host checking. 
Fixes to host checking wild card support and add support for
setting host checking flags when verifying a certificate
chain.
 2014-05-21 11:31:28 +01:00
Dr. Stephen Henson
558c94efc0 Fix for PKCS12_create if no-rc2 specified. 
Use triple DES for certificate encryption if no-rc2 is
specified.

PR#3357
 2014-05-21 11:28:58 +01:00
Andy Polyakov
3e68273326 aesv8-armx.pl: fix typo. 2014-05-20 23:32:12 +02:00
Andy Polyakov
a0a17fcb75 aesv8-armx.pl: optimize by adding 128-bit code paths. 2014-05-20 22:50:28 +02:00
Ben Laurie
d8ac1ea77e Don't allocate more than is needed in BUF_strndup(). 2014-05-20 13:52:31 +01:00
Janpopan
ff626ba5f4 Fix a wrong parameter count ERR_add_error_data 2014-05-19 22:10:14 +01:00
Andy Polyakov
5727e4dab8 Add "teaser" AES module for ARMv8. 
"Teaser" means that it's initial proof-of-concept to build EVP module
upon.
 2014-05-19 08:46:44 +02:00
Andy Polyakov
f75faa16af Add "teaser" AES module for PowerISA 2.07. 
"Teaser" means that it's not integrated yet and purpose of this
commit is primarily informational, to exhibit design choices,
such as how to handle alignment and endianness. In other words
it's proof-of-concept code that EVP module will build upon.
 2014-05-12 10:35:29 +02:00
Kurt Roeckx
3b3ecce141 Set authkey to NULL and check malloc return value. 2014-05-12 00:20:08 +01:00
Martin Brejcha
00f3a236e0 dgram_sctp_ctrl: authkey memory leak 
PR: 3327
 2014-05-12 00:20:08 +01:00
Dr. Stephen Henson
0bcb17a777 Return an error if no recipient type matches. 
If the key type does not match any CMS recipient type return
an error instead of using a random key (MMA mitigation). This
does not leak any useful information to an attacker.

PR#3348
 2014-05-09 14:24:54 +01:00
Matt Caswell
2d2e0479eb Fixed NULL pointer dereference in PKCS7_dataDecode reported by David Ramos in PR#3339 2014-05-07 23:21:02 +01:00
Geoff Thorpe
fce3821111 evp: prevent underflow in base64 decoding 
This patch resolves RT ticket #2608.

Thanks to Robert Dugal for originally spotting this, and to David
Ramos for noticing that the ball had been dropped.

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
 2014-05-06 17:52:19 -04:00
Geoff Thorpe
12e9f627f9 bignum: allow concurrent BN_MONT_CTX_set_locked() 
The lazy-initialisation of BN_MONT_CTX was serialising all threads, as
noted by Daniel Sands and co at Sandia. This was to handle the case that
2 or more threads race to lazy-init the same context, but stunted all
scalability in the case where 2 or more threads are doing unrelated
things! We favour the latter case by punishing the former. The init work
gets done by each thread that finds the context to be uninitialised, and
we then lock the "set" logic after that work is done - the winning
thread's work gets used, the losing threads throw away what they've done.

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
 2014-05-06 17:43:35 -04:00
Dr. Stephen Henson
3ba1e406c2 Initialize num properly. 
PR#3289
PR#3345
 2014-05-06 14:07:37 +01:00
Dr. Stephen Henson
546b1b4384 Set Enveloped data version to 2 if ktri version not zero. 2014-05-06 13:59:05 +01:00
Tim Hudson
8bbfd94e36 - fix coverity issues 966593-966596 2014-05-06 00:02:31 +01:00
Andy Polyakov
b943b7d2c7 md5/asm/md5-[586|x86_64].pl: +15% on Atom. 
[MD5 is hardly relevant, just cleaning up repository]
 2014-05-04 16:56:00 +02:00
Andy Polyakov
496f2b148b C64x+ assembply pack: add RC4 module. 2014-05-04 16:39:59 +02:00
Andy Polyakov
bd227733b9 C64x+ assembly pack: make it work with older toolchain. 2014-05-04 16:38:32 +02:00
Andy Polyakov
9250a30692 sha/asm/sha1-armv4-large.pl: add NEON and ARMv8 code paths. 
sha/asm/sha256-armv4.pl: add ARMv8 code path.
 2014-05-04 10:57:55 +02:00
Andy Polyakov
4afa9f033d crypto/armcap.c: detect ARMv8 capabilities [in 32-bit build]. 2014-05-04 10:55:49 +02:00
David Ramos
16ba70746b Double free in i2o_ECPublicKey 
PR: 3338
 2014-05-04 00:46:20 +01:00
Geoff Thorpe
da12bfca51 dso: eliminate VMS code on non-VMS systems 
Even though the meat of dso_vms.c is compiled out on non-VMS builds,
the (pre-)compiler still traverses some of the macro handling. This
trips up at least one non-VMS build configuration, so this commit
makes the skip-VMS case more robust.

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
 2014-05-01 21:59:36 -04:00
Geoff Thorpe
a529261891 bignum: fix boundary condition in montgomery logic 
It's not clear whether this inconsistency could lead to an actual
computation error, but it involved a BIGNUM being passed around the
montgomery logic in an inconsistent state. This was found using flags
-DBN_DEBUG -DBN_DEBUG_RAND, and working backwards from this assertion
in 'ectest';

ectest: bn_mul.c:960: BN_mul: Assertion `(_bnum2->top == 0) ||
(_bnum2->d[_bnum2->top - 1] != 0)' failed

Signed-off-by: Geoff Thorpe <geoff@openssl.org>
 2014-04-30 11:49:31 -04:00
mancha
e14f14d36e Fix eckey_priv_encode() 
Fix eckey_priv_encode to return an error on failure of i2d_ECPrivateKey.
 2014-04-26 07:59:13 +01:00
Geoff Thorpe
79c6c4e828 make depend 2014-04-25 14:31:05 -04:00
Andy Polyakov
f8cee9d081 bn/asm/armv4-gf2m.pl, modes/asm/ghash-armv4.pl: faster multiplication 
algorithm suggested in following paper:

Câmara, D.; Gouvêa, C. P. L.; López, J. & Dahab, R.: Fast Software
Polynomial Multiplication on ARM Processors using the NEON Engine.

http://conradoplg.cryptoland.net/files/2010/12/mocrysen13.pdf
 2014-04-24 10:24:53 +02:00
Andy Polyakov
558ff0f0c1 aes/asm/bsaes-x86_64.pl: Atom-specific optimization. 2014-04-24 10:13:30 +02:00
Ben Laurie
4ba5e63bfd Fix double frees. 2014-04-22 16:58:43 +01:00
Dr. Stephen Henson
300b9f0b70 Extension checking fixes. 
When looking for an extension we need to set the last found
position to -1 to properly search all extensions.

PR#3309.
 2014-04-15 18:50:53 +01:00
Dr. Stephen Henson
476830fd5b ssleay_rand_add returns a value in 1.1.0 2014-04-09 15:35:51 +01:00
Dr. Stephen Henson
f74fa33bce Return if ssleay_rand_add called with zero num. 
Treat a zero length passed to ssleay_rand_add a no op: the existing logic
zeroes the md value which is very bad. OpenSSL itself never does this
internally and the actual call doesn't make sense as it would be passing
zero bytes of entropy.

Thanks to Marcus Meissner <meissner@suse.de> for reporting this bug.
(cherry picked from commit 5be1ae28ef)
 2014-04-07 19:44:45 +01:00
Andy Polyakov
997d1aac7c crypto/modes/gcm128.c: more strict aliasing fixes. 2014-04-06 17:19:54 +02:00
Andy Polyakov
6eebcf3459 vpaes-[x86_64|ppc].pl: fix typo, which for some reason triggers rkhunter. 2014-04-06 12:50:36 +02:00
Eric Young
10378fb5f4 Fix base64 decoding bug. 
A short PEM encoded sequence if passed to the BIO, and the file
had 2 \n following would fail.

PR#3289
 2014-04-02 19:54:27 +01:00
Dr. Stephen Henson
b48310627d Don't try and verify signatures if key is NULL (CVE-2013-0166) 
Add additional check to catch this in ASN1_item_verify too.
(cherry picked from commit 66e8211c0b)
 2014-04-01 16:37:51 +01:00
Dr. Stephen Henson
2514fa79ac Add functions returning security bits. 
Add functions to return the "bits of security" for various public key
algorithms. Based on SP800-57.
 2014-03-28 14:49:04 +00:00
Dr. Stephen Henson
3a98f9cf20 Workaround for some CMS signature formats. 
Some CMS SignedData structure use a signature algorithm OID such
as SHA1WithRSA instead of the RSA algorithm OID. Workaround this
case by tolerating the signature if we recognise the OID.
 2014-03-19 17:28:01 +00:00
Dr. Stephen Henson
f9b6c0ba4c Fix for CVE-2014-0076 
Fix for the attack described in the paper "Recovering OpenSSL
ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
by Yuval Yarom and Naomi Benger. Details can be obtained from:
http://eprint.iacr.org/2014/140

Thanks to Yuval Yarom and Naomi Benger for discovering this
flaw and to Yuval Yarom for supplying a fix.
(cherry picked from commit 2198be3483)

Conflicts:

	CHANGES
 2014-03-12 14:29:43 +00:00
Andy Polyakov
5e44c144e6 SPARC T4 assembly pack: treat zero input length in CBC. 
The problem is that OpenSSH calls EVP_Cipher, which is not as
protective as EVP_CipherUpdate. Formally speaking we ought to
do more checks in *_cipher methods, including rejecting
lengths not divisible by block size (unless ciphertext stealing
is in place). But for now I implement check for zero length in
low-level based on precedent.

PR: 3087, 2775
 2014-03-07 10:30:37 +01:00
Andy Polyakov
53e5161231 dh_check.c: check BN_CTX_get's return value. 2014-03-06 14:19:37 +01:00
Andy Polyakov
972b0dc350 bss_dgram.c,d1_lib.c: make it compile with mingw. 
Submitted by: Roumen Petrov
 2014-03-06 14:04:56 +01:00
Dr. Stephen Henson
315cd871c4 For self signed root only indicate one error. 
(cherry picked from commit bdfc0e284c)
 2014-03-03 23:36:46 +00:00
Dr. Stephen Henson
5693a30813 PKCS#8 support for alternative PRFs. 
Add option to set an alternative to the default hmacWithSHA1 PRF
for PKCS#8 private key encryptions. This is used automatically
by PKCS8_encrypt if the nid specified is a PRF.

Add option to pkcs8 utility.

Update docs.
(cherry picked from commit b60272b01f)
 2014-03-01 23:16:08 +00:00
Dr. Stephen Henson
01757858fe Fix memory leak. 
(cherry picked from commit 124d218889)
 2014-03-01 23:15:53 +00:00
Andy Polyakov
b62a4a1c0e perlasm/x86asm.pl: recognize elf-1 denoting old ELF platforms. 2014-02-27 14:26:12 +01:00
Andy Polyakov
ce876d8316 perlasm/x86gas.pl: limit special OPENSSL_ia32cap_P treatment to ELF. 2014-02-27 14:22:13 +01:00
Andy Polyakov
f861b1d433 rc4/asm/rc4-586.pl: allow for 386-only build. 2014-02-27 14:19:19 +01:00
Andy Polyakov
fd361a67ef des/asm/des-586.pl: shortcut reference to DES_SPtrans. 2014-02-27 14:17:43 +01:00
Rob Stradling
52f71f8181 CABForum EV OIDs for Subject Jurisdiction of Incorporation or Registration. 2014-02-26 15:33:11 +00:00
Andy Polyakov
d49135e7ea sha/asm/sha256-586.pl: don't try to compile SIMD with no-sse2. 2014-02-26 10:22:13 +01:00
Andy Polyakov
147cca8f53 sha/asm/sha512-x86_64.pl: fix compilation error on Solaris. 2014-02-26 09:30:03 +01:00
Andy Polyakov
e704741bf3 aes/asm/vpaes-ppc.pl: fix traceback info. 2014-02-25 20:11:34 +01:00
Dr. Stephen Henson
e0520c65d5 Don't use BN_ULLONG in n2l8 use SCTS_TIMESTAMP. 
(cherry picked from commit 3678161d71)
 2014-02-25 15:06:51 +00:00
Dr. Stephen Henson
3a325c60a3 Fix for v3_scts.c 
Not all platforms define BN_ULLONG. Define SCTS_TIMESTAMP as a type
which should work on all platforms.
(cherry picked from commit 6634416732)
 2014-02-25 14:56:31 +00:00
Dr. Stephen Henson
a4cc3c8041 Avoid Windows 8 Getversion deprecated errors. 
Windows 8 SDKs complain that GetVersion() is deprecated.

We only use GetVersion like this:

	(GetVersion() < 0x80000000)

which checks if the Windows version is NT based. Use a macro check_winnt()
which uses GetVersion() on older SDK versions and true otherwise.
 2014-02-25 13:40:33 +00:00
Rob Stradling
19f65ddbab Parse non-v1 SCTs less awkwardly. 2014-02-25 10:14:51 +00:00
Andy Polyakov
758954e0d8 x509/by_dir.c: fix run-away pointer (and potential SEGV) 
when adding duplicates in add_cert_dir.

PR: 3261
Reported by: Marian Done
 2014-02-24 15:16:56 +01:00
Andy Polyakov
214368ffee aes/asm/aesni-x86[_64].pl: minor Atom-specific performance tweak. 2014-02-21 12:14:04 +01:00
Dr. Stephen Henson
47739161c6 fix WIN32 warnings 
(cherry picked from commit b709f8ef54)
 2014-02-20 22:55:24 +00:00
Dr. Stephen Henson
ded18639d7 Move CT viewer extension code to crypto/x509v3 2014-02-20 18:48:56 +00:00
Dr. Stephen Henson
4cfeb00be9 make depend 2014-02-19 20:09:08 +00:00
Dr. Stephen Henson
84917787b5 Remove references to o_time.h 2014-02-19 20:06:13 +00:00
Ben Laurie
ff49a94439 Move gmtime functions to crypto.h. 2014-02-19 18:02:04 +00:00
Ben Laurie
c0482547b3 Reverse export of o_time.h. 2014-02-19 17:57:07 +00:00