wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
12044 commits 20 branches 302 tags 153 MiB
Commit graph

6171 commits

Author SHA1 Message Date
Viktor Dukhovni
a09e4d24ad Client-side namecheck wildcards. 
A client reference identity of ".example.com" matches a server
certificate presented identity that is any sub-domain of "example.com"
(e.g. "www.sub.example.com).

With the X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS flag, it matches
only direct child sub-domains (e.g. "www.sub.example.com").
 2014-06-12 23:19:25 +01:00
Andy Polyakov
977f32e852 Facilitate back-porting of AESNI and SHA modules. 
Fix SEH and stack handling in Win64 build.
 2014-06-12 21:45:41 +02:00
Andy Polyakov
1cf8f57b43 ghash-x86_64.pl: optimize for upcoming Atom. 2014-06-11 11:34:18 +02:00
Andy Polyakov
619b94667c Add support for Intel SHA extension. 2014-06-11 10:27:45 +02:00
Rob Stradling
fd2309aa29 Separate the SCT List parser from the SCT List viewer 2014-06-10 23:44:13 +01:00
Andy Polyakov
e2eabed110 aesni-mb-x86_64.pl: add Win64 SEH. 2014-06-10 23:08:06 +02:00
Dr. Stephen Henson
7a9d59c148 Fix null pointer errors. 
PR#3394
 2014-06-10 14:47:29 +01:00
Jakub Wilk
7be1d8764d Create ~/.rnd with mode 0600 instead of 0666 
Because of a missing include <fcntl.h> we don't have O_CREATE and don't create
the file with open() using mode 0600 but fall back to using fopen() with the
default umask followed by a chmod().

Problem found by Jakub Wilk <jwilk@debian.org>.
 2014-06-08 21:15:48 +01:00
Andy Polyakov
5dcf70a1c5 ARM assembly pack: get ARMv7 instruction endianness right. 
Pointer out and suggested by: Ard Biesheuvel.
 2014-06-06 21:27:18 +02:00
Andy Polyakov
cd91fd7c32 sha[1|512]-armv8.pl: get instruction endianness right. 
Submitted by: Ard Biesheuvel.
 2014-06-06 20:50:43 +02:00
Andy Polyakov
82741e9c89 Engage GHASH for ARMv8. 2014-06-06 20:48:35 +02:00
Andy Polyakov
2d5a799d27 Add GHASH for ARMv8 Crypto Extension. 
Result of joint effort with Ard Biesheuvel.
 2014-06-06 20:43:02 +02:00
Andy Polyakov
65cad34b10 aesv8-armx.pl update: 
- fix 32-bit build (submitted by Ard Biesheuvel);
- fix performance issue in CTR;
 2014-06-06 12:18:51 +02:00
Andy Polyakov
d86689e1d9 aesp8-ppc.pl: fix typos. 2014-06-04 08:34:18 +02:00
Andy Polyakov
53a224bb0a evp/e_aes.c: add erroneously omitted break; 2014-06-04 08:33:06 +02:00
Libor Krystek
8e3231642b Corrected OPENSSL_NO_EC_NISTP_64_GCC_128 usage in ec_lcl.h. PR#3370 2014-06-03 23:15:58 +01:00
Andy Polyakov
030a3f9527 evp/e_aes.c: populate HWAES_* to remaning modes. 
Submitted by: Ard Biesheuvel.
 2014-06-02 21:48:02 +02:00
Andy Polyakov
de51e830a6 Engage POWER8 AES support. 2014-06-01 23:38:11 +02:00
Andy Polyakov
723463282f armv4cpuid.S: switch to CNTVCT tick counter. 2014-06-01 22:34:02 +02:00
Andy Polyakov
797d24bee9 sha[1|256]-armv4: harmonize with arm_arch.h. 2014-06-01 22:29:50 +02:00
Andy Polyakov
ddacb8f27b Engage ARMv8 AES support. 2014-06-01 22:20:37 +02:00
Andy Polyakov
f8aab6174c linux-aarch64: engage SHA modules. 2014-06-01 18:03:51 +02:00
Andy Polyakov
ddb6b965da Add SHA for ARMv8. 2014-06-01 18:02:11 +02:00
Andy Polyakov
e8d93e342b Add linux-aarch64 taget. 
armcap.c is shared between 32- and 64-bit builds and features link-time
detection of getauxval.

Submitted by: Ard Biesheuvel.
 2014-06-01 17:21:06 +02:00
Ben Laurie
c93233dbfd Tidy up, don't exceed the number of requested bits. 2014-06-01 15:31:27 +01:00
Ben Laurie
46838817c7 Constify and reduce coprime random bits to allow for multiplier. 2014-06-01 15:31:27 +01:00
Felix Laurie von Massenbach
8927c2786d Add a test to check we're really generating probable primes. 2014-06-01 15:31:27 +01:00
Felix Laurie von Massenbach
9a3a99748b Remove unused BIGNUMs. 2014-06-01 15:31:27 +01:00
Felix Laurie von Massenbach
c74e148776 Refactor the first prime index. 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
982c42cb20 Try skipping over the adding and just picking a new random number. 
Generates a number coprime to 2, 3, 5, 7, 11.

Speed:
Trial div (add) : trial div (retry) : coprime
1 : 0.42 : 0.84
 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
c09ec5d2a0 Generate safe primes not divisible by 3, 5 or 7. 
~2% speed improvement on trial division.
 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
b0513819e0 Add a method to generate a prime that is guaranteed not to be divisible by 3 or 5. 
Possibly some reduction in bias, but no speed gains.
 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
e46a059ebf Remove static from probable_prime_dh. 2014-06-01 15:31:26 +01:00
Felix Laurie von Massenbach
e55fca760b Remove indentation from the goto targets. 2014-06-01 15:31:26 +01:00
Dr. Stephen Henson
3009244da4 Set default global mask to UTF8 only. 2014-06-01 15:03:00 +01:00
Andy Polyakov
e09ea622bb aesv8-armx.pl: add CTR implementation. 
Submitted by: Ard Biesheuvel.
 2014-05-29 22:45:35 +02:00
Dr. Stephen Henson
46d889f33e Set version number correctly. 
PR#3249
 2014-05-29 14:33:32 +01:00
František Bořánek
4da0ddc47e Fix memory leak. 
PR#3278
 2014-05-29 14:33:32 +01:00
Martin Kaiser
1c4575ebc3 remove duplicate 0x for default RSASSA-PSS salt len 2014-05-29 14:33:32 +01:00
Andy Polyakov
7cbdb975c2 aesp8-ppc.pl: optimize CBC decrypt even further. 
10-19% improvement depending on key length and endianness.
 2014-05-29 15:10:12 +02:00
Ben Laurie
ba4477d649 Make it build. 
Closes #31.
 2014-05-25 17:35:04 +01:00
Christian Heimes
56431240ae add test case to makefiles 2014-05-25 17:35:04 +01:00
Christian Heimes
4d4a535dcf Implement tests for PKCS#5 PBKDF2 HMAC 2014-05-25 17:35:04 +01:00
Dr. Stephen Henson
0930251df8 Don't use expired certificates if possible. 
When looking for the issuer of a certificate, if current candidate is
expired, continue looking. Only return an expired certificate if no valid
certificates are found.

PR#3359
 2014-05-25 04:50:15 +01:00
Dr. Stephen Henson
6c21b860ba Rename vpm_int.h to x509_lcl.h 2014-05-25 04:50:14 +01:00
Luiz Angelo Daros de Luca
dd36fce023 OpenSSL is able to generate a certificate with name constraints with any possible 
subjectAltName field. The Name Contraint example in x509v3_config(5) even use IP
as an example:

	nameConstraints=permitted;IP:192.168.0.0/255.255.0.0

However, until now, the verify code for IP name contraints did not exist. Any
check with a IP Address Name Constraint results in a "unsupported name constraint
type" error.

This patch implements support for IP Address Name Constraint (v4 and v6). This code
validaded correcly certificates with multiple IPv4/IPv6 address checking against
a CA certificate with these constraints:

	permitted;IP.1=10.9.0.0/255.255.0.0
	permitted;IP.2=10.48.0.0/255.255.0.0
	permitted;IP.3=10.148.0.0/255.255.0.0
	permitted;IP.4=fdc8:123f:e31f::/ffff:ffff:ffff::

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
 2014-05-23 23:05:38 +01:00
Andy Polyakov
fda29b6db0 aesp8-ppc.pl: add optimized CBC decrypt. 2014-05-23 20:15:06 +02:00
Andy Polyakov
b83d09f552 vpaes-ppc.pl: comply with ABI. 2014-05-23 20:14:38 +02:00
Ben Laurie
eb33348879 Check length first in BUF_strnlen(). 2014-05-22 10:13:22 +01:00
Ben Laurie
12f1b3e79f Remove redundant test. 2014-05-21 12:03:02 +01:00