summaryrefslogtreecommitdiffstats
path: root/include
AgeCommit message (Collapse)Author
2016-03-09Add X509_CHECK_FLAG_NEVER_CHECK_SUBJECT flagViktor Dukhovni
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-03-10Remove duplicate typedef of ECPKPARAMETERS in ec.hRichard Levitte
Reviewed-by: Stephen Henson <steve@openssl.org>
2016-03-09Deprecate the use of version-specific methodsKurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
2016-03-09Fix usage of OPENSSL_NO_*_METHODKurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
2016-03-09Make SSL_CIPHER_get_version return a const char *Kurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-03-09Constify security callbacksKurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-03-09RT3676: Expose ECgroup i2d functionsRich Salz
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-03-09Document importance of CTLOG_STORE outliving SCT if SCT_set0_log is usedRob Percival
Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Makes STACK_OF(SCT)* parameter of i2d_SCT_LIST constRob Percival
Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Removes SCT_LIST_set_source and SCT_LIST_set0_logsRob Percival
Both of these functions can easily be implemented by callers instead. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Makes SCT_get0_log return const CTLOG*Rob Percival
Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Makes CTLOG_STORE_get0_log_by_id return const CTLOG*Rob Percival
Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Treat boolean functions as booleansRob Percival
Use "!x" instead of "x <= 0", as these functions never return a negative value. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Make parameters of CTLOG_get* constRob Percival
Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Extensive application of __owur to CT functions that return a booleanRob Percival
Also improves some documentation of those functions. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Makes SCT_LIST_set_source return the number of successesRob Percival
No longer terminates on first error, but instead tries to set the source of every SCT regardless of whether an error occurs with some. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Remove the old threading APIMatt Caswell
All OpenSSL code has now been transferred to use the new threading API, so the old one is no longer used and can be removed. We provide some compat macros for removed functions which are all no-ops. There is now no longer a need to set locking callbacks!! Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-09Convert rand code to new threading APIMatt Caswell
Replace the CRYPTO_LOCK_RAND and CRYPTO_LOCK_RAND2 locks with new thread API style locks. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert RSA blinding to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_SSL_* to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Remove the transfer of lock hooks from bind_engineRichard Levitte
With the new threads API, this is no longer needed. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-09Engine API repair - memory management hooksRichard Levitte
The Engine API lost the setting of memory management hooks in bind_engine. Here's putting that back. EX_DATA and ERR functions need the same treatment. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-03-08Convert mem_dbg and mem_sec to the new Thread APIMatt Caswell
Use new Thread API style locks, and thread local storage for mem_dbg Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08OpenSSLDie --> OPENSSL_dieRich Salz
Also removed a bunch of unused define's from e_os.h Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-08Make DSA_SIG opaque.Dr. Stephen Henson
This adds a new accessor function DSA_SIG_get0. The customisation of DSA_SIG structure initialisation has been removed this means that the 'r' and 's' components are automatically allocated when DSA_SIG_new() is called. Update documentation. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_X509_* to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_UI to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_EC_* to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_EVP_PKEY to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_BIO to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Add cipher query functionsTodd Short
Add functions to determine authentication, key-exchange, FIPS and AEAD. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert ERR_STRING_DATA to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert ERR_STATE to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_EX_DATA to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_DSO to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_{DH,DSA,RSA} to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08Convert CRYPTO_LOCK_GET*BYNAME to new multi-threading APIAlessandro Ghedini
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-08GH787: Fix ALPNTodd Short
* Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-07Remove kinv/r fields from DSA structure.Dr. Stephen Henson
The kinv/r fields in the DSA structure are not used by OpenSSL internally and should not be used in general. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07Rename EVP_CIPHER_CTX_cipher_data to EVP_CIPHER_CTX_get_cipher_dataMatt Caswell
We had the function EVP_CIPHER_CTX_cipher_data which is newly added for 1.1.0. As we now also need an EVP_CIPHER_CTX_set_cipher_data it makes more sense for the former to be called EVP_CIPHER_CTX_get_cipher_data. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Add an SSL_has_pending() functionMatt Caswell
This is similar to SSL_pending() but just returns a 1 if there is data pending in the internal OpenSSL buffers or 0 otherwise (as opposed to SSL_pending() which returns the number of bytes available). Unlike SSL_pending() this will work even if "read_ahead" is set (which is the case if you are using read pipelining, or if you are doing DTLS). A 1 return value means that we have unprocessed data. It does *not* necessarily indicate that there will be application data returned from a call to SSL_read(). The unprocessed data may not be application data or there could be errors when we attempt to parse the records. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Add an ability to set the SSL read buffer sizeMatt Caswell
This capability is required for read pipelining. We will only read in as many records as will fit in the read buffer (and the network can provide in one go). The bigger the buffer the more records we can process in parallel. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Implement write pipeline support in libsslMatt Caswell
Use the new pipeline cipher capability to encrypt multiple records being written out all in one go. Two new SSL/SSL_CTX parameters can be used to control how this works: max_pipelines and split_send_fragment. max_pipelines defines the maximum number of pipelines that can ever be used in one go for a single connection. It must always be less than or equal to SSL_MAX_PIPELINES (currently defined to be 32). By default only one pipeline will be used (i.e. normal non-parallel operation). split_send_fragment defines how data is split up into pipelines. The number of pipelines used will be determined by the amount of data provided to the SSL_write call divided by split_send_fragment. For example if split_send_fragment is set to 2000 and max_pipelines is 4 then: SSL_write called with 0-2000 bytes == 1 pipeline used SSL_write called with 2001-4000 bytes == 2 pipelines used SSL_write called with 4001-6000 bytes == 3 pipelines used SSL_write_called with 6001+ bytes == 4 pipelines used split_send_fragment must always be less than or equal to max_send_fragment. By default it is set to be equal to max_send_fragment. This will mean that the same number of records will always be created as would have been created in the non-parallel case, although the data will be apportioned differently. In the parallel case data will be spread equally between the pipelines. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Update the dasync engine to add a pipeline cipherMatt Caswell
Implement aes128-cbc as a pipeline capable cipher in the dasync engine. As dasync is just a dummy engine, it actually just performs the parallel encrypts/decrypts in serial. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Add defines for pipeline capable ciphersMatt Caswell
Add a flag to indicate that a cipher is capable of performing "pipelining", i.e. multiple encrypts/decrypts in parallel. Also add some new ctrls that ciphers will need to implement if they are pipeline capable. Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-03-07Elide OPENSSL_INIT_set_config_filename() for no-stdio buildDavid Woodhouse
Strictly speaking, it isn't stdio and file access which offend me here; it's the fact that UEFI doesn't provide a strdup() function. But the fact that it's pointless without file access is a good enough excuse for compiling it out. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07Elide DES_read_password() for no-ui buildDavid Woodhouse
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07Move declaration of X509_aux_print() out of #ifndef OPENSSL_NO_STDIODavid Woodhouse
This isn't a file access function; it's still present. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-07Elide EVP_read_pw_string() and friends for no-uiDavid Woodhouse
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-03-07Add a function to detect if we have async or notMatt Caswell
Add the ASYNC_is_capable() function and use it in speed. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-28 08:23:45 +0000