summaryrefslogtreecommitdiffstats
path: root/crypto
AgeCommit message (Collapse)Author
2016-01-25Move & split opensslconf.h.inRich Salz
Move opensslconf.h.in to include/openssl. Split off DES,BN,RC4 stuff into separate header file templates in crypto/include/internal/*_conf.h.in Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-24Move pqueue into sslRich Salz
This is an internal facility, never documented, not for public consumption. Move it into ssl (where it's only used for DTLS). I also made the typedef's for pqueue and pitem follow our style: they name structures, not pointers. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-24Fix two possible leaks.FdaSilvaYY
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #580
2016-01-24Fix possible memory leak on BUF_MEM_grow_clean failureFdaSilvaYY
Simplify BUF_MEM init. code Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #580
2016-01-23Fix store with opaque dataTodd Short
When experimental-store is enabled, it does not compile due to the change to opaque data structures. Change CRYPTO_add() to EVP_PKEY_up_ref() as needed. Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> RT: #4263, GH: #579
2016-01-23free item after sk_push failmrpre
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-23Refactor file writing - rewrite crypto/opensslconf.h.in as templateRichard Levitte
The turn has come to have crypto/opensslconf.h.in get run through util/dofile.pl. The consequence is that a large number of variables get moved to the %config table. Also, the string variables $openssl_*, which were populated with cpp lines, all being of the form "#define SOMETHING", were converted into ARRAY refs in %config values, containing just the list of macros to be defined. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-21RT3863 ECC: Add missing NULL check. Set a flagBilly Brumley
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-01-20Reject when explicit trust EKU are set and none match.Viktor Dukhovni
Returning untrusted is enough for for full chains that end in self-signed roots, because when explicit trust is specified it suppresses the default blanket trust of self-signed objects. But for partial chains, this is not enough, because absent a similar trust-self-signed policy, non matching EKUs are indistinguishable from lack of EKU constraints. Therefore, failure to match any trusted purpose must trigger an explicit reject. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-20Check Suite-B constraints with EE DANE recordsViktor Dukhovni
When DANE-EE(3) matches or either of DANE-EE/PKIX-EE fails, we don't build a chain at all, but rather succeed or fail with just the leaf certificate. In either case also check for Suite-B violations. As unlikely as it may seem that anyone would enable both DANE and Suite-B, we should do what the application asks. Took the opportunity to eliminate the "cb" variables in x509_vfy.c, just call ctx->verify_cb(ok, ctx) Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-20Add an engine destructor to eng_cryptodev.Richard Levitte
Reviewed-by: Ben Laurie <ben@openssl.org>
2016-01-20Adapt BSD cryptodev engine to opaque EVP_MD_CTX, EVP_CIPHER_CTX, etcRichard Levitte
Reviewed-by: Ben Laurie <ben@openssl.org>
2016-01-20Remove update tagsRich Salz
Also remove depend/local_depend. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-20Consolidate "make update"Rich Salz
Rename 'update' to 'generate'. Rather than recurse, just explicitly call the three generate targets directly. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-20make EVP_PKEY opaqueDr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-19Remove the GOST engineMatt Caswell
The GOST engine is now out of date and is removed by this commit. An up to date GOST engine is now being maintained in an external repository. See: https://wiki.openssl.org/index.php/Binaries Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-19prf redirection build fixesDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-19Add TLS PRF method.Dr. Stephen Henson
Add EVP_PKEY algorithm for TLS1 PRF. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-01-18Drop cached certificate signature validity flagViktor Dukhovni
It seems risky in the context of cross-signed certificates when the same certificate might have multiple potential issuers. Also rarely used, since chains in OpenSSL typically only employ self-signed trust-anchors, whose self-signatures are not checked, while untrusted certificates are generally ephemeral. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-18Use POSIX functions on Cygwin, not Win32 functionCorinna Vinschen
Signed-off-by: Corinna Vinschen <vinschen@redhat.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-17Accessor update; fix API, document one.Rich Salz
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-17Remove some old makefile targetsRich Salz
Remove lint, tags, dclean, tests. This is prep for a new makedepend scheme. This is temporary pending unified makefile, and might help it. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-17Add some accessors.Rich Salz
Author: Remi Gacogne <rgacogne-github@coredump.fr> GH334: Add an OCSP_SINGLERESP_get0_id() accessor to the OCSP_CERTID of a OCSP_SINGLERESP. It is possible to do it the other way around using OCSP_resp_find(), but this is more efficient when you have a tree indexed by OCSP_CERTID, like haproxy does. (This is also RT4251) Author: Marek Klein <kleinmrk@gmail.com> GH556: OCSP_resp_get_produced_at() accessor to the producedAt of a OCSP_BASICRESP GH555: TS_STATUS_INFO_get_status(), TS_STATUS_INFO_get_text() and TS_STATUS_INFO_get_failure_info() accessors for a TS_STATUS_INFO Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-17RT4247: Add missing patchRich Salz
Missed the camellia EVP update. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-16Empty SNI names are not validViktor Dukhovni
While empty inputs to SSL_set1_host() clear the reference identifier list. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-15RT4247: Fix EVP_CIPHER_CTX opaque on sparcRich Salz
Via Rainer Jung Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-15Add lookup_certs for a trusted stack.Dr. Stephen Henson
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-15NGX-2040 - fix wildcard match on punycode/IDNA DNS namesZi Lin
- bugfix: should not treat '--' as invalid domain substring. - '-' should not be the first letter of a domain Signed-off-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-14Cosmetic polish for last-resort depth 0 checkViktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-14Fix last-resort depth 0 check when the chain has multiple certificatesViktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-14Add a no-egd option to disable EGD-related codeBenjamin Kaduk
The entropy-gathering daemon is used only on a small number of machines. Provide a configure knob so that EGD support can be disabled by default but re-enabled on those systems that do need it. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-14Always initialize X509_STORE_CTX get_crl pointerViktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13Call single parent free_comp routine.Rich Salz
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-13Fix double-free bugs in EC group precomputation stateViktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13Fix nistp512 typos, should be nistp521Viktor Dukhovni
Note, this now compiles, but fails tests, so further remediation is required. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-13Add missing #ifdef's to fix build breakRich Salz
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-13Add CRYPTO_EX_DATA; remove EC_EXTRA_DATARich Salz
Add CRYPTO_EX_DATA add EndC_KEY_[gs]et_method, From Roumen Petrov. Had to add various exdata calls to init/copy/free the exdata. Had to remove const from some EC functions because exdata isn't const-correct. :( Also remove EC_EXTRA_DATA and use a union to hold the possible pre-computed values and an enum to tell which value is in the union. (Rich Salz) Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-13Fix DES_LONG breakageViktor Dukhovni
For some strange reason opensslconf.h was only defining DES_LONG when included via des.h, but that's exceedingly fragile (as a result of include guards the include via des.h might not actually process the content again). Ripped out the nesting constraint, now always define OSSL_DES_LONG if not already defined. Note, this could just be DES_LONG, but trying to avoid exposing DES_LONG in places where it has never been seen before, so it is up to des.h to actually define DES_LONG as OSSL_DES_LONG. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13After EVP_CIPHER turned opaque, e_rc5.c needs to include evp_int.hRichard Levitte
We missed this one because rc5 is disabled by default. Notified by The Doctor <doctor@doctor.nl2k.ab.ca> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Move Makefiles to Makefile.inRich Salz
Create Makefile's from Makefile.in Rename Makefile.org to Makefile.in Rename Makefiles to Makefile.in Address review feedback from Viktor and Richard Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-12Remove unused internal macrosRichard Levitte
The M_EVP_* macros related to EVP_CIPHER / EVP_CIPHER_CTX are not public, and are unused. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12make updateRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Adapt all EVP_CIPHER users for it becoming opaqueRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12EVP_CIPHER_CTX_new_cipher_data was a temporary measure, not needed any moreRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Adapt all engines that need it to opaque EVP_CIPHERRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Adapt builtin cipher implementations to opaque EVP_CIPHERRichard Levitte
They all stop including evp_locl.h, so we also take care of their adaptation to opaque EVP_CIPHER_CTX, as was promised in an earlier commit. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Adapt the internal EVP routines to opaque EVP_CIPHERRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Make EVP_CIPHER opaque and add creator/destructor/accessor/writer functionsRichard Levitte
We follow the method used for EVP_MD. Also, move all the internal EVP_CIPHER building macros from evp_locl.h to evp_int.h. This will benefit our builtin EVP_CIPHERs. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Remove EVP_CIPHER_CTX_flags, it's only confusingRichard Levitte
EVP_CIPHER_CTX_flags was returning the flags of its associated EVP_CIPHER. However, EVP_CIPHER_CTX has flags of its own, so this function is quite confusing and therefore error prone. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Adapt all EVP_CIPHER_CTX users for it becoming opaqueRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 21:34:05 +0000