wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
8437 commits 20 branches 302 tags 153 MiB
Commit graph

1157 commits

Author SHA1 Message Date
Bodo Möller
aa9fed8cc2 refer to latest draft for AES ciphersuites 2002-05-07 07:56:09 +00:00
Bodo Möller
29f6a99432 disable AES ciphersuites unless explicitly requested 2002-05-05 23:47:09 +00:00
Lutz Jänicke
fb0f53b2e0 Fix escaping when using the -subj option of "openssl req", document 
'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
Submitted by:
Reviewed by:
PR: #2
 2002-04-30 12:10:10 +00:00
Bodo Möller
dfc5336975 Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not 
encoded as NULL) with id-dsa-with-sha1.

Submitted by: Nils Larsch
 2002-04-26 08:29:18 +00:00
Bodo Möller
d4a67e3186 check return values 
Submitted by: Nils Larsch
 2002-04-17 09:31:02 +00:00
Lutz Jänicke
18e10315e5 Document OID changes. 
Submitted by:
Reviewed by:
PR:
 2002-04-15 14:17:20 +00:00
Lutz Jänicke
a6198b9ed1 Some more OID enhancements. 
Submitted by:
Reviewed by:
PR:
 2002-04-15 10:38:37 +00:00
Lutz Jänicke
a7be294ed7 Fix CRLF problem in BASE64 decode. 
Submitted by:
Reviewed by:
PR:
 2002-04-15 09:53:47 +00:00
Bodo Möller
a9ab63c01c Implement known-IV countermeasure. 
Fix length checks in ssl3_get_client_hello().

Use s->s3->in_read_app_data differently to fix ssl3_read_internal().
 2002-04-13 22:51:26 +00:00
Bodo Möller
2d96549cd0 looks like a typo 2002-04-12 13:51:42 +00:00
Bodo Möller
b48892d403 synchronize with main branch 2002-04-12 13:46:46 +00:00
Lutz Jänicke
9be529f12d In preparation of 0.9.7: re-order changelog, so that the changes 
are listed as of ... -> 0.9.6c -> 0.9.6d -> 0.9.7
Submitted by:
Reviewed by:
PR:
 2002-04-10 19:50:23 +00:00
Bodo Möller
2826fcc851 add usage examples 2002-04-09 11:53:51 +00:00
Lutz Jänicke
ce34d0ac09 Fix buggy object definitions (Svenning Sorensen <sss@sss.dnsalias.net>). 
Submitted by:
Reviewed by:
PR:
 2002-04-04 17:49:39 +00:00
Lutz Jänicke
75b9c0044c Make short names of objects RFC2256-compliant. 
Submitted by:
Reviewed by:
PR:
 2002-03-26 17:15:32 +00:00
Richard Levitte
600b77a93f Add the possibility to enable olde des support, not just disable it, for future support. Redocument 2002-03-26 14:26:08 +00:00
Bodo Möller
afcf54a5c9 fix DH_generate_parameters for general 'generator' 2002-03-20 16:02:46 +00:00
Lutz Jänicke
3671e38af4 Map new X509 verification errors to alert codes (Tom Wu <tom@arcot.com>). 
Submitted by:
Reviewed by:
PR:
 2002-03-19 16:44:26 +00:00
Bodo Möller
0bdbc5a86e fix ssl3_pending 2002-03-15 10:52:03 +00:00
Lutz Jänicke
abecef77cf Add missing strength classification. 
Submitted by:
Reviewed by:
PR:
 2002-03-14 18:47:51 +00:00
Dr. Stephen Henson
c913cf446f ENGINE module additions. 
Add "init" command to control ENGINE
initialization.

Call ENGINE_finish on initialized ENGINEs on exit.

Reorder shutdown in apps.c: modules should be shut
down first.

Add test private key loader to openssl ENGINE: this
just loads a private key in PEM format.

Fix print format for dh length parameter.
 2002-03-06 14:09:46 +00:00
Richard Levitte
cea698f19c Document the added modes for AES 2002-02-28 11:30:42 +00:00
Bodo Möller
48781ef7f7 Add 'void *' argument to app_verify_callback. 
Submitted by: D. K. Smetters <smetters@parc.xerox.com>
Reviewed by: Bodo Moeller
 2002-02-28 10:55:52 +00:00
Geoff Thorpe
6d1a837df7 This adds a new ENGINE to support IBM 4758 cards, contributed by Maurice 
Gittens.
 2002-02-27 22:45:48 +00:00
Lutz Jänicke
3b79d2789d Make sure that bad sessions are removed in SSL_clear() (found by 
Yoram Zahavi).
Submitted by:
Reviewed by:
PR:
 2002-02-26 21:44:07 +00:00
Dr. Stephen Henson
344b3b5ce1 OPENSSL_LOAD_CONF define as in main trunk 2002-02-23 02:09:29 +00:00
Dr. Stephen Henson
0cd8572b2d Config code updates. 
CONF_modules_unload() now calls CONF_modules_finish()
automatically.

Default use of section openssl_conf moved to
CONF_modules_load()

Load config file in several openssl utilities.

Most utilities now load modules from the config file,
though in a few (such as version) this isn't done
because it couldn't be used for anything.

In the case of ca and req the config file used is
the same as the utility itself: that is the -config
command line option can be used to specify an
alternative file.
 2002-02-22 13:58:15 +00:00
Dr. Stephen Henson
9c75b2d931 Use default openssl.cnf if config filename set to NULL and 
openssl_conf if appname NULL.
 2002-02-19 23:25:18 +00:00
Dr. Stephen Henson
86a0d0234d Add argument to OPENSSL_config() and add flag to 
tolerate missing config file.
 2002-02-14 23:39:36 +00:00
Richard Levitte
be37dc73f6 At Corinna Vinschen's request, change CygWin32 to Cygwin 2002-02-14 12:29:32 +00:00
Richard Levitte
1fe198b6f9 Update the configuration of CygWin32 to use the new capabilities of 
CygWin 1.3.x, which includes thread and shared library support.

Submitted by Corinna Vinschen <vinschen@redhat.com> and modified a
little bit.
 2002-02-13 14:44:33 +00:00
Lutz Jänicke
acfe628b6e Make removal from session cache more robust. 2002-02-10 12:46:41 +00:00
Lutz Jänicke
4de920c91d Do not store unneeded data. 2002-02-08 15:15:04 +00:00
Richard Levitte
3cd039dd8f Add notes on the added support for aep and sureware crypto cards in 
0.9.7.
 2002-02-07 22:15:53 +00:00
Richard Levitte
b9a3ef4c6e ASN1_BIT_STRING_set_bit() didn't clear previously set bits 2002-02-03 21:31:41 +00:00
Richard Levitte
1199e2d8cf Apply patch from Toomas Kiisk <vix@cyber.ee> and complete it. 2002-01-29 12:36:01 +00:00
Richard Levitte
a3fffd648b Add old patch from Robert Dahlem <Robert.Dahlem@ffm2.siemens.de> to 
make it possible to produce shared libraries on ReliantUNIX.
 2002-01-26 03:17:27 +00:00
Richard Levitte
2d57b73a50 I got a request to make the "old des" symbols more closely tied to 
OpenSSL.  Adding '_ossl' in the name seems to be a good way to do
this.
 2002-01-26 01:14:09 +00:00
Richard Levitte
f14845d999 Apply Neale Ferguson's patch to add a configuration target for linux-s390x 2002-01-25 22:06:59 +00:00
Richard Levitte
80bb905d3d Apply the following changes by Toomas Kiisk <vix@cyber.ee>: 
* make openssl rsa work with -engine chil
* misc changes, including debug-linux-ppro Configure target
  and FORMAT_NETSCAPE-aware load_{,pub}key()

This completes the application of his changes.
 2002-01-25 19:43:52 +00:00
Richard Levitte
8242a6a9fc Document the change in rsautl. 2002-01-25 17:00:56 +00:00
Bodo Möller
a14e2d9dfe New functions 
ERR_peek_last_error
    ERR_peek_last_error_line
    ERR_peek_last_error_line_data
(supersedes ERR_peek_top_error).

Rename OPENSSL_NO_OLD_DES_SUPPORT into OPENSSL_DISABLE_OLD_DES_SUPPORT
because OPENSSL_NO_... indicates disabled algorithms (according to
mkdef.pl).
 2002-01-24 16:16:43 +00:00
Bodo Möller
a8b94d6409 Reword CHANGES entry for _old_des_..., as it was a little complicated 
syntactically.
 2002-01-24 14:05:55 +00:00
Richard Levitte
1285221370 To avoid all kinds of link-level clashes, rename all old des_* 
functions to _old_des_*.
 2002-01-24 12:26:50 +00:00
Lutz Jänicke
9b2f486c9e Document the current behaviour of the DES interface. 2002-01-23 10:12:45 +00:00
Dr. Stephen Henson
df5eaa8a52 default_algorithms option in ENGINE config. 2002-01-22 01:40:18 +00:00
Dr. Stephen Henson
c9501c223f Initial ENGINE config module, docs to follow. 
Fix buffer overrun errors in OPENSSL_conf().
 2002-01-21 03:02:36 +00:00
Bodo Möller
8c74b5e56c Bugfix: In ssl3_accept, don't use a local variable 'got_new_session' 
to indicate that a real handshake is taking place (the value will be
lost during multiple invocations). Set s->new_session to 2 instead.
 2002-01-14 23:40:26 +00:00
Bodo Möller
c59ba5b528 Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c) if 
the SSL_R_LENGTH_MISMATCH error is detected.
 2002-01-14 12:37:59 +00:00
Dr. Stephen Henson
bc37d996fc Experimental configuration code. 
Incomplete, largely untested and subject to change/deletion.
 2002-01-05 01:37:16 +00:00
Bodo Möller
d59fb0dd2f Changes that break something should be included in CHANGES 
to make it easier to fix things.
 2002-01-04 13:27:52 +00:00
Bodo Möller
e5d6528a12 fix EVP_CIPHER_mode macro 
Submitted by: "Dan S. Camper" <dan@bti.net>
 2002-01-04 13:04:45 +00:00
Richard Levitte
6f9079fd50 Because Rijndael is more known as AES, use crypto/aes instead of 
crypto/rijndael.  Additionally, I applied the AES integration patch
from Stephen Sprunk <stephen@sprunk.org> and fiddled it to work
properly with the normal EVP constructs (and incidently work the same
way as all other symmetric cipher implementations).

This results in an API that looks a lot like the rest of the OpenSSL
cipher suite.
 2002-01-02 16:55:35 +00:00
Ulf Möller
dcbbf83dba ssl3_read_bytes bug fix 
Submitted by: D P Chang <dpc@qualys.com>
Reviewed by: Bodo
 2001-12-28 17:14:35 +00:00
Bodo Möller
3c89d78dba update FAQ and CHANGES file (0.9.6c has been released) 2001-12-21 12:29:52 +00:00
Ben Laurie
7c517a04b1 Security fix. 2001-12-20 12:18:08 +00:00
Bodo Möller
b5348a095d consistency with 0.9.6 stable "CHANGES" 2001-12-17 19:11:03 +00:00
Bodo Möller
66df02fd98 fix BN_rand_range 2001-12-14 10:09:29 +00:00
Dr. Stephen Henson
f3e24baddf Don't overwrite signing time. 2001-12-07 00:36:32 +00:00
Bodo Möller
35e25255e0 crypto/objects stuff 2001-12-03 14:03:23 +00:00
Dr. Stephen Henson
21a85f1977 Add -pubkey option to req command. 2001-12-01 23:03:30 +00:00
Bodo Möller
898f856c44 info on 0.9.6 engine branch 2001-11-23 21:12:44 +00:00
Bodo Möller
883b0c2274 fix submitted by Andy Schneider <andy.schneider@bjss.co.uk> 
(in main branch, hn_ncipher.c is already correct)
 2001-11-23 20:58:40 +00:00
Bodo Möller
1d4581c2dd OS/390 support 
Submitted by: Richard Shapiro <rshapiro@abinitio.com>
 2001-11-22 11:09:42 +00:00
Bodo Möller
76c4336c43 wNAFs use does not bring that much performance on Sparcs (where 
elliptic curves are are relatively faster than on PCs anyway)
 2001-11-16 12:02:01 +00:00
Bodo Möller
3ba1f11147 Improve EC efficiency. 2001-11-15 22:32:11 +00:00
Bodo Möller
1b28ed575b consistency between main branch and stable branch 2001-11-14 21:17:39 +00:00
Bodo Möller
b26ca3408c synchronise with 0.9.6 stable branch 2001-11-12 23:22:29 +00:00
Bodo Möller
83978bd37a information on 0.9.6c-engine 2001-11-12 22:10:15 +00:00
Bodo Möller
c5571db0c2 Add unixware-7-gcc as in 0.9.6 branch (except that we need a 'sys_id' 
field here, which is left empty).

Various configurations are *only* in the 0.9.6 branch at the moment:
  OpenUNIX
  OpenUNIX-8-gcc-shared
  OpenUNIX-8-shared
Either Configure or CHANGES must be changed to rectify the situation.
 2001-11-12 15:31:39 +00:00
Bodo Möller
7aa983c6db Order chronologically: move entry for recent s2_clnt.c/s2_srvr.c fixes 
(nearly) to the top.

Move msg_callback entry to the top as the implementation for SSL 2.0
is based on the s2_clnt.c/s2_srvr.c changes.
 2001-11-10 15:14:00 +00:00
Bodo Möller
2b90b1f344 make code a little more similar to what it looked like before the fixes, 
call ssl2_part_read again to parse error message
 2001-11-10 10:44:15 +00:00
Bodo Möller
cf82191d77 Implement msg_callback for SSL 2.0. 
Important SSL 2.0 bugfixes (bugs found while implementing msg_callback).
 2001-11-10 01:16:28 +00:00
Richard Levitte
a7b42009c4 Change the shared library support so the shared libraries get built 
sooner and the programs get built against the shared libraries.

This requires a bit more work.  Things like -rpath and the possibility
to still link the programs statically should be included.  Some
cleanup is also needed.  This will be worked on.
 2001-10-30 08:00:59 +00:00
Dr. Stephen Henson
7d5b04db4e Add support for Subject Info Acess extension. 2001-10-27 00:16:53 +00:00
Bodo Möller
48b0cf8b10 Note BUF_MEM_grow() consistency fix. 2001-10-26 14:06:33 +00:00
Bodo Möller
c602e7f4e8 disable caching in BIO_gethostbyname 2001-10-26 13:04:23 +00:00
Dr. Stephen Henson
1fc6d41bf6 New options to allow req to accept UTF8 strings as input. 2001-10-26 12:40:38 +00:00
Ben Laurie
0e21156333 Add paralellism to speed - note that this currently causes a weird memory leak. 2001-10-25 14:27:17 +00:00
Bodo Möller
89da653fa6 Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of 
the e-mail address in the DN (i.e., it will go into a certificate
extension only).  The new configuration file option 'email_in_dn = no'
has the same effect.

Submitted by: Massimiliano Pala madwolf@openca.org
 2001-10-25 08:25:19 +00:00
Bodo Möller
ba1c602281 Assume TLS 1.0 when ClientHello fragment is too short. 2001-10-25 06:09:51 +00:00
Richard Levitte
c2e4f17c1a Due to an increasing number of clashes between modern OpenSSL and 
libdes (which is still used out there) or other des implementations,
the OpenSSL DES functions are renamed to begin with DES_ instead of
des_.  Compatibility routines are provided and declared by including
openssl/des_old.h.  Those declarations are the same as were in des.h
when the OpenSSL project started, which is exactly how libdes looked
at that time, and hopefully still looks today.

The compatibility functions will be removed in some future release, at
the latest in version 1.0.
 2001-10-24 21:21:12 +00:00
Bodo Möller
979689aa5c Fix SSL handshake functions and SSL_clear() such that SSL_clear() 
never resets s->method to s->ctx->method when called from within
one of the SSL handshake functions.
 2001-10-24 19:03:22 +00:00
Dr. Stephen Henson
50d194af4d Sanitize CHANGES entry. 2001-10-23 00:54:58 +00:00
Dr. Stephen Henson
f1558bb424 Reject certificates with unhandled critical extensions. 2001-10-21 02:09:15 +00:00
Bodo Möller
a661b65357 New functions SSL[_CTX]_set_msg_callback(). 
New macros SSL[_CTX]_set_msg_callback_arg().

Message callback imlementation for SSL 3.0/TLS 1.0 (no SSL 2.0 yet).

New '-msg' option for 'openssl s_client' and 'openssl s_server'
that enable a message callback that displays all protocol messages.


In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert if
client_version is smaller than the protocol version in use.
Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0
if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the
client will at least see that alert.

Fix SSL[_CTX]_ctrl prototype (void * instead of char * for generic
pointer).

Add/update some OpenSSL copyright notices.
 2001-10-20 17:56:36 +00:00
Dr. Stephen Henson
581f1c8494 Modify EVP cipher behaviour in a similar way 
to digests to retain compatibility.
 2001-10-17 00:37:12 +00:00
Dr. Stephen Henson
20d2186c87 Retain compatibility of EVP_DigestInit() and EVP_DigestFinal() 
with existing code.

Modify library to use digest *_ex() functions.
 2001-10-16 01:24:29 +00:00
Bodo Möller
48948d53b6 Change ssl3_get_message and the functions using it so that complete 
'Handshake' protocol structures are kept in memory, including
'msg_type' and 'length'.

(This is in preparation of future support for callbacks that get to
peek at handshake messages and the like.)
 2001-10-15 19:49:25 +00:00
Richard Levitte
285046ec51 SSL_add_dir_cert_subjects_to_stack for Win32 finally implemented. 
Submitted by Massimo Santin <msantin@santineassociati.com>.
 2001-10-04 12:27:39 +00:00
Geoff Thorpe
07cee70258 Make an (overdue) note about the recent ENGINE restructuring. Apart from 
a few items however, most of the details are deferred to the
crypto/engine/README file.
 2001-10-01 15:56:25 +00:00
Dr. Stephen Henson
d46c1a8126 Support fractional seconds in GeneralizedTime 2001-09-28 00:44:44 +00:00
Richard Levitte
89eeccacde Two changes: 
1. if there are several symbols with the same entry number, sort those
   symbols in ASCII order.
2. Do not stop reading the header files when "BEGIN ERROR CODES" is
   found, since mkerr.pl will add a function declaration after that
   comment.  Instead, trigger on "Error codes for the \w+ function",
   which is the actual start of the error code macros.

Additionally, a few more debugging printouts that helped.
 2001-09-26 15:06:45 +00:00
Bodo Möller
3b0b5abae3 bugfix: handle HelloRequest received during handshake correctly 2001-09-21 11:18:40 +00:00
Bodo Möller
b49124f6d9 Disable session related stuff in SSL_ST_OK case of ssl3_accept if we 
just sent a HelloRequest.
 2001-09-21 07:01:25 +00:00
Bodo Möller
2260ad21fb Bugfix: correct cleanup after sending a HelloRequest 2001-09-21 00:04:15 +00:00
Bodo Möller
6b0e9facf4 New function SSL_renegotiate_pending(). 
New option SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION.
 2001-09-20 22:54:09 +00:00
Bodo Möller
8e2f6b79ea fix ssl3_accept: don't call ssl_init_wbio_buffer() in HelloRequest case 2001-09-20 21:37:13 +00:00
Bodo Möller
ee60d9fb28 Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't 
reveal whether illegal block cipher padding was found or a MAC
verification error occured.

In ssl/s2_pkt.c, verify that the purported number of padding bytes is in
the legal range.
 2001-09-20 18:35:52 +00:00
Dr. Stephen Henson
96bd6f730a Add certificate and request demos. 
Fix X509V3 macro so they compile.
 2001-09-12 00:19:20 +00:00
Lutz Jänicke
c0f5dd070b Make maximum certifcate chain size accepted from the peer application 
settable (proposed by "Douglas E. Engert" <deengert@anl.gov>).
 2001-09-11 13:08:51 +00:00
Bodo Möller
e13ae96d7c While ispell may not like it, "cancelling" may be spelt with two "l"s 2001-09-10 18:59:53 +00:00
Ulf Möller
e3fefbfd56 ispell 2001-09-07 06:39:38 +00:00
Lutz Jänicke
6c36f7a9f2 Support for shared libraries on Unixware-7 and OpenUNIX-8 
(Boyd Lynn Gerber <gerberb@zenez.com>).
 2001-09-06 12:39:00 +00:00
Bodo Möller
a9ed4da8eb improve OAEP check 2001-09-06 10:42:56 +00:00
Bodo Möller
3cad81f6fe Mention DSO_up => DSO_up_ref renaming 2001-09-05 21:39:39 +00:00
Bodo Möller
4450107afb Renaming DH_up to DH_up_ref does not warrant a CHANGES entry of its own 
as the functions were only introduced a couple of days ago.

Some '*)' apparently should be '+)' as the changes do not apply
to the 0.9.6 bugfix branch.
 2001-09-05 19:14:53 +00:00
Geoff Thorpe
908efd3b73 ENGINEs can now perform structural cleanup. 2001-09-05 19:07:01 +00:00
Geoff Thorpe
541814c403 Add some missing CHANGES items. 2001-09-05 17:50:24 +00:00
Ulf Möller
d98a4b7366 bug fix: bn_sqr_recursive output is twice its input size. 2001-09-05 04:43:43 +00:00
Bodo Möller
6ee2a1365e CHANGES should list all API changes relevant for applications 
(here: X509_STORE_CTX_init())
 2001-09-04 11:13:01 +00:00
Geoff Thorpe
5b16639538 Note the "ERR_unload_strings" function. 2001-09-03 18:27:22 +00:00
Bodo Möller
983495c4b2 Use uniformly chosen witnesses for Miller-Rabin test 
(by using new BN_pseudo_rand_range function)
 2001-09-03 12:58:16 +00:00
Ben Laurie
2618893114 Make MD functions take EVP_MD_CTX * instead of void *, add copy() function. 2001-09-02 20:05:27 +00:00
Geoff Thorpe
36026dfc01 Note the "ex_data" changes. 2001-09-01 20:20:16 +00:00
Geoff Thorpe
0783bf151c Note the "ERR" changes. 2001-08-25 17:59:13 +00:00
Geoff Thorpe
eb6dc02b23 Make a note of the "up" functions. 2001-08-25 17:37:46 +00:00
Lutz Jänicke
e7cf7fcd21 Allow client certificate lists > 16kB ("Douglas E. Engert" <deengert@anl.gov>.) 2001-08-25 11:49:24 +00:00
Lutz Jänicke
a403188f92 Alert description strings for TLSv1 and documentation. 2001-08-19 16:20:42 +00:00
Ben Laurie
0e36019977 Add EVP test program. 2001-08-18 13:53:01 +00:00
Ben Laurie
354c3ace73 Add first cut symmetric crypto support. 2001-08-18 10:22:54 +00:00
Dr. Stephen Henson
35bf35411c Add CRL utility functions to allow CRLs to be 
built up without accessing structures directly.

Update ca.c to use new functions.

Fix ca.c so it now build CRLs correctly again.
 2001-08-17 00:33:43 +00:00
Lutz Jänicke
54fbc77dc8 Bugfixes provided by "Stephen Hinton" <shinton@netopia.com>. 2001-08-16 15:28:00 +00:00
Richard Levitte
6bc847e49e Apply the Tru64 patch from Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu> 
His comments are:

1) Changes all references for `True64' to be `Tru64', which is the correct
spelling for the OS name.

2) Makes `alpha-cc' be the same as `alpha164-cc', and adds an `alphaold-cc'
entry that is the same as the previous `alpha-cc'.  The reason is that most
people these days are using the newer compiler, so it should be the default.

3) Adds a bit of commentary to Configure, regarding the name changes of
the OS over the years, so it's not so confusing to people that haven't been
with the OS for a while.

4) Adds an `alpha-cc-rpath' target (which is *not* selected automatically
by Configure under any circumstance) that builds an RPATH into the
shared libraries.  This is explained in the comment in Configure.  It's
very very useful for people that want it, and people that don't want it
just shouldn't choose that target.

5) Adds the `-pthread' flag as the best way to get POSIX thread support
from the newer compiler.

6) Updates the Makefile targets, so that when the `alpha164-cc', `alpha-cc',
or `alpha-cc-rpath' target is what Configure is set to use, it uses a Makefile
target that includes the `-msym' option when building the shared library.
This is a performance enhancement.

7) Updates `config' so that if it detects you're running version 4 or 5
of the OS, it automatically selects `alpha-cc', but uses `alphaold-cc'
for versions 1-3 of the OS.

8) Updates the comment in opensslv.h, fixing both the OS name typo and
adding a reference to IRIX 6.x, since the shared library semantics are
virtually identical there.
 2001-08-10 15:26:21 +00:00
Bodo Möller
37a7cd1a11 Bugfix: larger message size in ssl3_get_key_exchange() because 
ServerKeyExchange message may be skipped.

Submitted by:  Petr Lampa <lampa@fee.vutbr.cz>
 2001-08-07 09:30:18 +00:00
Bodo Möller
6383bbe525 remove a comma 2001-08-03 09:28:02 +00:00
Lutz Jänicke
06da6e4977 Don't disable rollback attack detection as a recommended bug workaround. 2001-08-03 08:45:13 +00:00
Lutz Jänicke
b72faddc47 Mention removed option. 2001-08-01 10:07:55 +00:00
Ben Laurie
8408f4fbc7 Document DES changes better. 2001-07-31 13:33:58 +00:00
Ben Laurie
dbad169019 Really add the EVP and all of the DES changes. 2001-07-30 23:57:25 +00:00
Andy Polyakov
6d03b73e35 Enhanced support for IA-64 Linux and HP-UX (as well as better support for 
HP-UX in common in ./config). Note that for the moment of this writing
none of 64-bit platforms pass bntest. I'm committing this anyway as it's
too frustrating to patch snapshots over and over while 0.9.6 is known to
work.
 2001-07-30 16:42:15 +00:00
Lutz Jänicke
1f0c9ad7e1 Fix inconsistent behaviour with respect to verify_callback handling. 2001-07-30 11:45:34 +00:00
Lutz Jänicke
06efc222f9 Forgot to mention second fix. 2001-07-30 11:33:53 +00:00
Bodo Möller
924875e53b Undo DH_generate_key() change: s3_srvr.c was using it correctly 2001-07-27 22:34:25 +00:00
Dr. Stephen Henson
19da130053 First of several reorganisations to 
reduce linker bloat. For example the
single line:

PEM_read_X509()

results in a binary of around 400K in Linux!

This first step separates some of the PEM functions and
avoids linking in some PKCS#7 and PKCS#12 code.
 2001-07-26 22:34:45 +00:00
Lutz Jänicke
a75b191502 Fix problem occuring when used from OpenSSH on Solaris 8. 2001-07-26 09:02:44 +00:00
Bodo Möller
6aecef815c Don't preserve existing keys in DH_generate_key. 2001-07-25 17:20:34 +00:00
Bodo Möller
daba492c3a md_rand.c thread safety 2001-07-25 17:17:24 +00:00
Bodo Möller
24cff6ced5 always reject data >= n 2001-07-25 17:02:58 +00:00
Bodo Möller
badb910f3c Avoid race condition. 
Submitted by: Travis Vitek <vitek@roguewave.com>
 2001-07-24 12:31:14 +00:00
Ben Laurie
c518ade1fd Clean up EVP macros, rename DES EDE3 modes correctly, temporary support for 
OpenBSD /dev/crypto (this will be revamped later when the appropriate machinery
is available).
 2001-07-21 10:24:07 +00:00
Dr. Stephen Henson
ee306a1332 Initial OCSP server support, using index.txt format. 
This can process internal requests or behave like a
mini responder.

Todo: documentation, update usage info.
 2001-07-12 20:41:51 +00:00
Richard Levitte
e452de9d87 Add the possibility to specify the use of zlib compression and 
decompression.  It can be set up to link at link time or to load the
zlib library at run-time.
 2001-07-12 09:11:14 +00:00
Richard Levitte
0665dd6852 Document the recent Kerberos SSL changes. 2001-07-12 04:23:57 +00:00
Geoff Thorpe
af436bc158 openssl speed is quite useful for testing hardware support (among other 
things), especially as the RSA keys are fixed. However, DSA only fixes the
DSA parameters and then generates the public and private components on the
fly each time - this commit hard-codes some sampled key values so that this
is no longer the case.
 2001-07-11 18:59:25 +00:00
Bodo Möller
e9ad0d2c31 Fix PRNG. 2001-07-10 10:49:34 +00:00
Ben Laurie
c148d70978 A better compromise between encrypt and decrypt (but why isn't it as fast 
for encrypt?).
 2001-07-09 21:00:36 +00:00
Ben Laurie
f31b12503e Use & instead of % - worth about 4% for 8 byte blocks. 2001-07-08 17:27:32 +00:00
Bodo Möller
d63c6bd397 Align with 0.9.6-stable CHANGES file, and make some corrections. 2001-07-04 20:56:47 +00:00
Bodo Möller
93dbd83570 Entry for Andy's mips3.s fix. 2001-07-04 20:17:27 +00:00
Lutz Jänicke
43f9391bcc When only the key is given to "enc", the IV is undefined 
(found by Andy Brown <logic@warthog.com>).
 2001-07-03 10:31:11 +00:00
Richard Levitte
c80410c50c Insuline shot 2001-07-01 23:15:43 +00:00
Dr. Stephen Henson
b7a26e6daf Modify apps to use NCONF code instead of old CONF code. 
Add new extension functions which work with NCONF.

Tidy up extension config routines and remove redundant code.

Fix NCONF_get_number().

Todo: more testing of apps to see they still work...
 2001-06-28 11:41:50 +00:00
Dr. Stephen Henson
1e325f6149 Handle empty X509_NAME in printing routines. 2001-06-26 12:04:35 +00:00
Bodo Möller
c458a33196 DSA verification should insist that r and s are in the allowed range. 2001-06-26 09:48:17 +00:00
Richard Levitte
fd3e027faa Oops, applies to 0.9.7 only. 2001-06-23 16:28:21 +00:00
Richard Levitte
235dd0a22a Document recent changes. 2001-06-23 16:27:37 +00:00
Dr. Stephen Henson
323f289c48 Change all calls to low level digest routines in the library and 
applications to use EVP. Add missing calls to HMAC_cleanup() and
don't assume HMAC_CTX can be copied using memcpy().

Note: this is almost identical to the patch submitted to openssl-dev
by Verdon Walker <VWalker@novell.com> except some redundant
EVP_add_digest_()/EVP_cleanup() calls were removed and some changes
made to avoid compiler warnings.
 2001-06-19 22:30:40 +00:00
Richard Levitte
839590f576 - Add the possibility to control engines through control names but 
with arbitrary arguments instead of just a string.
- Change the key loaders to take a UI_METHOD instead of a callback
  function pointer.  NOTE: this breaks binary compatibility with
  earlier versions of OpenSSL [engine].
- Addapt the nCipher code for these new conditions and add a card
  insertion callback.
 2001-06-19 16:12:18 +00:00
Richard Levitte
9ad0f6812f Enhance the user interface with better support for dialog box 
prompting, application-defined prompts, the possibility to use
defaults (for example default passwords from somewhere else) and
interrupts/cancelations.
 2001-06-19 15:52:00 +00:00
Dr. Stephen Henson
3cc1f498a1 Don't set pointer if add_lock_callback used. 2001-06-19 00:04:57 +00:00
Bodo Möller
285b42756a pay attention to blocksize before attempting decryption 2001-06-15 18:05:09 +00:00
Bodo Möller
8a774dc9a6 Add directory name to the entry on /crypto/ui/. 2001-06-11 09:55:20 +00:00
Dr. Stephen Henson
f2a253e0dd Add support for MS CSP Name PKCS#12 attribute. 2001-06-11 00:43:20 +00:00
Bodo Möller
ecf186065c OAEP fix 2001-06-06 21:44:28 +00:00
Bodo Möller
31bc51c8cf Fix Bleichenbacher PKCS #1 1.5 countermeasure. 
(The attack against SSL 3.1 and TLS 1.0 is impractical anyway,
otherwise this would be a security relevant patch.)
 2001-06-01 09:41:25 +00:00
Geoff Thorpe
d918f85146 Fix a memory leak in 'sk_dup' in the case a realloc() fails. Also, tidy up 
a bit of weird code in sk_new.
 2001-05-31 19:01:08 +00:00
Lutz Jänicke
7e97837274 Don't forget responsible person so that its clear who is to blame. 2001-05-29 13:52:21 +00:00
Richard Levitte
79bb8d0077 Document the latest change in ENGINEs. 2001-05-26 16:58:34 +00:00
Dr. Stephen Henson
76c919c1a3 Add missing variable length cipher flag for Blowfish. 
Only use trust settings if either trust or reject settings
are present, otherwise use compatibility mode. This stops
root CAs being rejected if they have alias of keyid set.
 2001-05-24 22:58:35 +00:00
Lutz Jänicke
e8734731d3 Increase ENTROPY_NEEDED to support Rijndael's larger key size. 2001-05-15 16:02:35 +00:00
Richard Levitte
496da8b918 Document the addition. 2001-05-13 10:37:02 +00:00
Dr. Stephen Henson
4831e626aa Change Win32 to use EXPORT_VAR_AS_FN. 
Fix OPENSSL_IMPLEMENT_GLOBAL.

Allow Win32 to use EXPORT_VAR_AS_FN in mkdef.pl

make update.
 2001-05-12 23:57:41 +00:00
Lutz Jänicke
3351b8d007 Update changelog to reflect additional changes made to the egd-locations. 2001-05-10 09:45:31 +00:00
Bodo Möller
4b49bf6a93 restore change undone in 1.831 (apparently by accident) 2001-05-10 09:33:18 +00:00
Dr. Stephen Henson
926a56bfe3 Purpose and trust setting functions for X509_STORE. 
Tidy existing code.
 2001-05-10 00:13:59 +00:00
Dr. Stephen Henson
bdee69f718 Allow various X509_STORE_CTX properties to be 
inherited from X509_STORE.

Add CRL checking options to other applications.
 2001-05-09 00:30:39 +00:00
Bodo Möller
ff43e2e155 fix an old entry 2001-05-08 12:45:55 +00:00
Dr. Stephen Henson
b545dc6775 Initial CRL based revocation checking. 2001-05-07 22:52:50 +00:00
Richard Levitte
a63d5eaab2 Add a general user interface API. This is designed to replace things 
like des_read_password and friends (backward compatibility functions
using this new API are provided).  The purpose is to remove prompting
functions from the DES code section as well as provide for prompting
through dialog boxes in a window system and the like.
 2001-05-06 23:19:37 +00:00
Bodo Möller
24cc290b85 .rnd issues 2001-05-03 09:27:43 +00:00
Richard Levitte
d02408ad8a Remove part conflict indicator... 2001-05-02 07:15:03 +00:00
Geoff Thorpe
e5a77633cf Make notes about ENGINE changes. 2001-04-26 20:42:12 +00:00
Dr. Stephen Henson
c962479bdf Fix ASN1 bug when decoding OTHER type. 
Various S/MIME DSA related fixes.
 2001-04-21 12:06:01 +00:00
Geoff Thorpe
2a8a10eda6 Add notes about the new ENGINE functionality. 2001-04-19 23:06:00 +00:00
Geoff Thorpe
4d6115a5cc Make a note of the recent ENGINE developments. 2001-04-18 21:12:02 +00:00
Bodo Möller
3a25b96caf typo 2001-04-18 15:11:42 +00:00
Bodo Möller
6e6d04e29a fix md_rand.c locking bugs 2001-04-18 15:07:35 +00:00
Bodo Möller
f2346808de update so that changes going into the 0.9.6 tree can be logged 2001-04-12 12:42:20 +00:00
Bodo Möller
a9d2bc4902 Add information on 0.9.6a (in a form such that the list can be 
verified by looking at 'diff -u ../openssl-0.9.6a/CHANGES CHANGES')
 2001-04-11 10:35:38 +00:00
Bodo Möller
1f224bf029 Adjust BN_mod_inverse algorithm selection according to experiments on 
Ultra-Sparcs (both 32-bit and 64-bit compilations)
 2001-04-09 09:28:24 +00:00
Bodo Möller
7d0d0996aa binary algorithm for modular inversion 2001-04-08 18:23:44 +00:00
Bodo Möller
5f1fddbbe7 '||', '&&' and 'test -x' apparently don't work on Ultrix; 
also 'test' appears to be available as '[' only in 'if' conditions.
 2001-04-08 13:49:45 +00:00
Richard Levitte
4ac881ede3 Fix couple of memory leaks in PKCS7_dataDecode(). 
(provided by Stephen)
 2001-04-05 10:19:12 +00:00
Bodo Möller
6186ef9338 don't use shell functions 2001-04-04 16:26:31 +00:00
Richard Levitte
967d95f096 Incorporate some changes that make OpenSSL compilable in CygWin. 2001-04-04 15:50:30 +00:00
Dr. Stephen Henson
722ca2781c Rewrite CHOICE field setting code to properly handle 
combine in CHOICE options.

This was causing d2i_DSAPublicKey() to misbehave.
 2001-04-02 00:59:19 +00:00
Ulf Möller
c9fd9152bd Note the Alpha asm change 2001-03-31 01:23:10 +00:00
Bodo Möller
884e26080f Fix bctest, and add a workaround that should solve the problem with 
FreeBSD's /bin/sh.
 2001-03-30 09:19:18 +00:00
Richard Levitte
080b8cadfa Since there has been reports of clashes between OpenSSL's 
des_encrypt() and des_encrypt() defined on some systems (Solaris and
Unixware and maybe others), we rename des_encrypt() to des_encrypt1().
This should have very little impact on external software unless
someone has written a mode of DES, since that's all des_encrypt() is
meant for.
 2001-03-29 07:45:37 +00:00