summaryrefslogtreecommitdiffstats
path: root/include
AgeCommit message (Collapse)Author
2016-02-09Use NON_EMPTY_TRANSLATION_UNIT, consistently.Rich Salz
This also closes RT 4123 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09Updates for auto init/deinit review commentsMatt Caswell
Fixes for the auto-init/deinit code based on review comments Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09Provide a thread stop APIMatt Caswell
Add the OPENSSL_INIT_thread_stop() function. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09Auto init/de-init libsslMatt Caswell
Building on the pervious commit to auto initialise and de-initialise libssl Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09Auto init/deinit libcryptoMatt Caswell
This builds on the previous commit to auto initialise/deinitialise libcrypto. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-09Provide framework for auto initialise/deinitialise of the libraryMatt Caswell
This commit provides the basis and core code for an auto initialisation and deinitialisation framework for libcrypto and libssl. The intention is to remove the need (in many circumstances) to call explicit initialise and deinitialise functions. Explicit initialisation will still be an option, and if non-default initialisation is needed then it will be required. Similarly for de-initialisation (although this will be a lot easier since it will bring all de-initialisation into a single function). Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-08Suppress DANE TLSA reflection when verification failsViktor Dukhovni
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08Remove ancient compatibility defines.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08Only use compatibility macros for < 1.1 API.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08use new function namesDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08Reorganise functions.Dr. Stephen Henson
Move all PKCS12_SAFEBAG functions into new file p12_sbag.c. Move MAC functions into p12_mutl.c Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08pkcs12.h header reorganisation.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08Rename PKCS12 functionDr. Stephen Henson
Rename ancient PKCS12 functions to use more logical names. Include defines from old to new name. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08pkcs12 accessorsDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08New PKCS12 accessors, change macros to functions.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08Make PKCS12 structures opaqueDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-08Deprecate undocumented SSL_cache_hit().Dr. Stephen Henson
Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-08Handle SSL_shutdown while in init more appropriately #2Matt Caswell
Previous commit 7bb196a71 attempted to "fix" a problem with the way SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had SSL_shutdown() return immediately having taken no action if called mid- handshake with a return value of 1 (meaning everything was shutdown successfully). In fact the shutdown has not been successful. Commit 7bb196a71 changed that to send a close_notify anyway and then return. This seems to be causing some problems for some applications so perhaps a better (much simpler) approach is revert to the previous behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown was not successful). This also fixes a bug where SSL_shutdown always returns 0 when shutdown *very* early in the handshake (i.e. we are still using SSLv23_method). Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-06Add SSL_get0_verified_chain() to return verified chain of peerDr. Stephen Henson
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Add a BIO_ADDR_clear functionMatt Caswell
Adds a new function BIO_ADDR_clear to reset a BIO_ADDR back to an unitialised state, and to set the family to AF_UNSPEC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05GH601: Various spelling fixes.FdaSilvaYY
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-05Make DTLSv1_listen a first class function and change its typeMatt Caswell
The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-05Long overdue cleanup of X509 policy tree verificationViktor Dukhovni
Replace all magic numbers with #defined constants except in boolean functions that return 0 for failure and 1 for success. Avoid a couple memory leaks in error recovery code paths. Code style improvements. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-02-05Add EC_KEY_priv2buf()Dr. Stephen Henson
Add new function EC_KEY_priv2buf() to allocated and encode private key octet in one call. Update and simplify ASN.1 and print routines. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05update EC ASN1 and print routinesDr. Stephen Henson
Update EC ASN.1 and print routines to use EC_KEY_oct2priv and EC_KEY_priv2oct. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Add EC_KEY_oct2priv and EC_KEY_priv2octDr. Stephen Henson
New functions EC_KEY_oct2priv and EC_KEY_priv2oct. These are private key equivalents of EC_POINT_oct2point and EC_POINT_point2oct which convert between the private key octet format and EC_KEY. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-05Add ASN1_buf_print to print a buffer in ASN1_bn_print format.Dr. Stephen Henson
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-04Add new DTLS-SRTP protection profiles from RFC 7714Dmitry Sobinov
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-04Use WSAGetLastError() on windowsKurt Roeckx
Windows doesn't have h_error or hstrerror() Reviewed-by: Richard Levitte <levitte@openssl.org> MR: #1848
2016-02-04update OID tablesDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-03RT2752: Add some EKU OID'sRich Salz
And some others found in the Internet. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-03Tweak opensslconf.h.in for styleRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-03make updateRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: adapt BIO_s_connect and BIO_s_acceptRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03make updateRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03make updateRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: new socket-handling functions, deprecate older onesRichard Levitte
Added functions: BIO_socket BIO_connect BIO_listen BIO_accept_ex BIO_closesocket BIO_sock_info These get deprecated: BIO_gethostbyname BIO_get_port BIO_get_host_ip BIO_get_accept_socket BIO_accept Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: add error macros & text, and make updateRichard Levitte
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-03Refactoring BIO: add wrappers around sockaddr et alRichard Levitte
Because different platforms have different levels of support for IPv6, different kinds of sockaddr variants, and some have getaddrinfo et al while others don't, we could end up with a mess if ifdefs, duplicate code and other maintainance nightmares. Instead, we're introducing wrappers around the common form for socket communication: BIO_ADDR, closely related to struct sockaddr and some of its variants. BIO_ADDRINFO, closely related to struct addrinfo. With that comes support routines, both convenient creators and accessors, plus a few utility functions: BIO_parse_hostserv, takes a string of the form host:service and splits it into host and service. It checks for * in both parts, and converts any [ipv6-address] syntax to ust the IPv6 address. BIO_lookup, looks up information on a host. All routines handle IPv4 (AF_INET) and IPv6 (AF_INET6) addresses, and there is support for local sockets (AF_UNIX) as well. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-02RT2353: Add ipsec IKE OIDRich Salz
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-02-02New BN functions.Dr. Stephen Henson
Add new function BN_bn2binpad() which checks the length of the output buffer and pads the result with zeroes if necessary. New functions BN_bn2lebinpad() and BN_lebin2bn() which use little endian format. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-01Style; add "!= NULL"Rich Salz
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-02-01constify PACKETEmilia Kasper
PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31Compat self-signed trust with reject-only aux dataViktor Dukhovni
When auxiliary data contains only reject entries, continue to trust self-signed objects just as when no auxiliary data is present. This makes it possible to reject specific uses without changing what's accepted (and thus overring the underlying EKU). Added new supported certs and doubled test count from 38 to 76. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31Check chain extensions also for trusted certificatesViktor Dukhovni
This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-31Add EC_GROUP_order_bits, EC_GROUP_get0_order and EC_GROUP_get0_cofactorDr. Stephen Henson
New functions to return internal pointer for order and cofactor. This avoids the need to allocate a new BIGNUM which to copy the value to. Simplify code to use new functions. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31RT4129: BUF_new_mem_buf should take const void *Daniel Kahn Gillmor
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-30GH102: Extra volatile avoids GCC bugRich Salz
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-01-30Remove extra level of indirection.Rich Salz
Remove OPENSSL_IMPORT as its only purpose is to define OPENSSL_EXTERN. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-30Move more BN internals to bn_lcl.hRich Salz
There was an unused macro in ssl_locl.h that used an internal type, so I removed it. Move bio_st from bio.h to ossl_type.h Reviewed-by: Andy Polyakov <appro@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-15 14:30:23 +0000