summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2017-07-16Standardize apps use of -rand, etc.Rich Salz
Standardized the -rand flag and added a new one: -rand file... Always reads the specified files -writerand file Always writes to the file on exit For apps that use a config file, the RANDFILE config parameter reads the file at startup (to seed the RNG) and write to it on exit if the -writerand flag isn't used. Ensured that every app that took -rand also took -writerand, and made sure all of that agreed with all the documentation. Fix error reporting in write_file and -rand Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3862)
2017-07-16Don't use "version" in "OpenSSL Version 1.1.0" etcRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3938)
2017-07-17Address Coverity issues.Pauli
This patch addresses the use of uninitialised data raised in Coverity issues 1414881 and 1414882. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3929)
2017-07-15sha/asm/keccak1600-avx2.pl: optimized remodelled version.Andy Polyakov
New register usage pattern allows to achieve sligtly better performance. Not as much as I hoped for. Performance is believed to be limited by irreconcilable write-back conflicts, rather than lack of computational resources or data dependencies. Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-07-15sha/asm/keccak1600-avx2.pl: remodel register usage.Andy Polyakov
This gives much more freedom to rearrange instructions. This is unoptimized version, provided for reference. Basically you need to compare it to initial 29724d0e15b4934abdf2d7ab71957b05d1a28256 to figure out the key difference. Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-07-15testutil: stanza files are text files, open them as suchRichard Levitte
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3939)
2017-07-15OSSL_STORE "file" scheme loader: check that a DOS device is correctly namedRichard Levitte
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15OSSL_STORE "file" scheme loader: check for absolute path in URI laterRichard Levitte
If we have a local file with a name starting with 'file:', we don't want to check if the part after 'file:' is absolute. Instead, mark each possibility for absolute check if needed, and perform the absolute check later on, when checking each actual path. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15test/recipes/90-test_store.t: Add a few cases with files starting with 'file:'Richard Levitte
These cases are performed on Linux only. They check that files with names starting with 'file:' can be processed as well. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15OSSL_STORE: Treat URIs as files first (with exceptions), then as full URIsRichard Levitte
To handle paths that contain devices (for example, C:/foo/bar.pem on Windows), try to "open" the URI using the file scheme loader first, and failing that, check if the device is really a scheme we know. The "file" scheme does the same kind of thing to pick out the path part of the URI. An exception to this special treatment is if the URI has an authority part (something that starts with "//" directly after what looks like a scheme). Such URIs will never be treated as plain file paths. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15OSSL_STORE: spell error reason correctlyRichard Levitte
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15test/recipes/90-test_store.t: Test absolute filesRichard Levitte
We haven't tested plain absolute paths without making them URIs... Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15test/recipes/90-test_store.t: Rename some functionsRichard Levitte
to_rel_file_uri really treated all files appropriately, absolute and relative alike, and really just constructs a URI, so gets renamed to to_file_uri to_file_uri, on the other hand, forces the path into an absolute one, so gets renamed to to_abs_file_uri Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3907)
2017-07-15Start to overhaul RAND APIRich Salz
Remove unused rand_hw_xor, MD/EVP indirection Make rand_pseudo same as rand. Cleanup formatting and ifdef control Rename some things: - rand_meth to openssl_rand_meth; make it global - source file - lock/init functions, start per-thread state - ossl_meth_init to ossl_rand_init Put state into RAND_STATE structure And put OSSL_RAND_STATE into ossl_typ.h Use "randomness" instead of "entropy" Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3758)
2017-07-14For Windows, use _stat rather than statRichard Levitte
This allows for better flexibility with mixed /M compiler flags Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3930)
2017-07-14Fix style in crypto/store/loader_file.cRichard Levitte
With added commenting to describe the individual decoders a little more. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3930)
2017-07-14Update PR#3925Roelof duToit
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
2017-07-14Retry SSL_read on ERROR_WANT_READ.Roelof duToit
This resolves the retry issue in general, but also the specific case where a TLS 1.3 server sends a post-handshake NewSessionTicket message prior to appdata. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
2017-07-14Fix #946 Add -preserve_dates to x509 appTodd Short
Add the -preserve_dates dates option to preserve dates when signing a certificate. Prevent -days and -preserve_dates being used simultaneously Fixes #946 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/946)
2017-07-13Fix bug in err_string_data_cmpRich Salz
Unsigned overflow. Thanks to Brian Carpenter for reporting this. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3887)
2017-07-14Remove trailing blanks.Pauli
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3918)
2017-07-14Test cleaning and modernisationPauli
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3917)
2017-07-14Change return (x) to return xPauli
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3912)
2017-07-14Avoid having an unsigned integer decrement below zero.Pauli
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3912)
2017-07-14Fix some issues raise by coverity in the tests.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3846)
2017-07-13Add sanity test for certificate tableDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Move certificate table to header file so it can be tested.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Add additional ECDSA/Ed25519 selection tests.Dr. Stephen Henson
Add two tests with ECDSA+SHA256 preferred over Ed25519, the second also excludes P-256 from the supported curves extension which will force the use of Ed25519 in TLS 1.2, but not TLS 1.3: this would fail before the certificate table updates. Add TLS 1.3 test also with P-256 exclude from the groups extension: this should have no effect as the groups extension is not used for signature selection in TLS 1.3 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Use cert tables in ssl_set_sig_maskDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13make errorsDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Use cert tables instead of X509_certificate_typeDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Use certificate tables instead of ssl_cert_typeDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Use certificate tables instead of ssl_cipher_get_cert_index.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Replace tls12_get_pkey_idxDr. Stephen Henson
The functiontls12_get_pkey_idx is only used to see if a certificate index is enabled: call ssl_cert_is_disabled instead. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Add SSL_aCERT: this is used for any ciphersuite with a certificate.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Add certificate properties table.Dr. Stephen Henson
Add certificate table giving properties of each certificate index: specifically the NID associated with the index and the the auth mask value for any cipher the certificate can be used with. This will be used to generalise certificate handling instead of hard coding algorithm specific cases. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3858)
2017-07-13Demo style fixes and modernisation.Pauli
Address some style issues in the demos and modernise the C. Fix the exit/return from main handling. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3914)
2017-07-12coding style: remove extra whitespace charactorhongliang
CLA: trivial Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3913)
2017-07-12Rewrite RAND_egdRich Salz
Use stdio and its buffering. Limit to 255 bytes (could remove that if neceessary). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3888)
2017-07-10Fix error handling in get_header_and_data.Bernd Edlinger
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3896)
2017-07-10Fix crash in BUF_MEM_grow_clean.Bernd Edlinger
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3896)
2017-07-10Optimize sha/asm/keccak1600-avx2.pl.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-07-10Add sha/asm/keccak1600-avx2.pl.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org>
2017-07-07Trivial bounds checking.Pauli
Bounds checking strpy, strcat and sprintf. These are the remaining easy ones to cover a recently removed commit. Some are trivial, some have been modified and a couple left as they are because the reverted change didn't bounds check properly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3871)
2017-07-08Fix cipher_compareRichard Levitte
Unsigned overflow. Found by Brian Carpenter Fixes #3889 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3890)
2017-07-07Update various RAND podpagesRich Salz
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3883)
2017-07-07Fix s_client crash where the hostname is provided as a positional argMatt Caswell
If the hostname is provided as a positional arg then s_client crashes. The crash occurs as s_client exits (after either a successful or unsuccessful connection attempt). This issue was introduced by commit 729ef85611. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3881)
2017-07-07Some SSL_OP_ values can't be used in 1.1.xMatt Caswell
SSL_OP_ALL was set in 0x0BFF so reusing some of these bits would cause ABI compatibility issues. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
2017-07-07Choose a safer value for SSL_OP_ALLOW_NO_DHE_KEXMatt Caswell
1.1.0 included the previous value for SSL_OP_ALLOW_NO_DHE_KEX in SSL_OP_ALL. This might cause binary compatibility issues. We should choose a value that is not in SSL_OP_ALL. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
2017-07-07Update the documentation for the new SSL_OP_ALLOW_NO_DHE_KEX optionMatt Caswell
Also the associated configuration parameters and command line switches. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-06 06:17:03 +0000