summaryrefslogtreecommitdiffstats
path: root/include
AgeCommit message (Collapse)Author
2016-08-16Convert PKCS8* functions to use const gettersMatt Caswell
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-08-16Convert TS_STATUS_INFO* functions to use const gettersMatt Caswell
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
2016-08-16Provide compat macros for SSL_CTX_set_ecdh_auto() and SSL_set_ecdh_auto()Matt Caswell
These functions are no longer relevant to 1.1.0 (we always have auto ecdh on) - but no reason to break old code that tries to call it. The macros will only return a dummy "success" result if the app was trying to enable ecdh. Disabling can't be done in quite this way any more. Fixes Github Issue #1437 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-08-16Add ASN1_STRING_get0_data(), deprecate ASN1_STRING_data().Dr. Stephen Henson
Deprecate the function ASN1_STRING_data() and replace with a new function ASN1_STRING_get0_data() which returns a constant pointer. Update library to use new function. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-15Make CT_POLICY_EVAL_CTX_set1_{cert,issuer} into boolean functionsRob Percival
They may fail if they cannot increment the reference count of the certificate they are storing a pointer for. They should return 0 if this occurs. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1408)
2016-08-15Improves CTLOG_STORE settersRob Percival
Changes them to have clearer ownership semantics, as suggested in https://github.com/openssl/openssl/pull/1372#discussion_r73232196. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1408)
2016-08-13Add point ctrls to X25519Dr. Stephen Henson
Add ctrl operations to set or retrieve encoded point in EVP_PKEY structures containing X25519 keys. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-13make errorsDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-13Use OIDs from draft-ietf-curdle-pkix-02Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-12GH1446: Add SSL_SESSION_get0_cipherRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1451)
2016-08-10Add #defines for magic numbers in API.Rich Salz
Binary- and backward-compatible. Just better. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1429)
2016-08-10Fix spelling of error codeKurt Roeckx
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1421)
2016-08-10Add some const castsRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1397)
2016-08-10GH1383: Add casts to ERR_PACKRich Salz
Reviewed-by: Emilia Käsper <emilia@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1385
2016-08-05Mkae CT_log_new_from_base64 always return 0 on failureRob Percival
In one failure case, it used to return -1. That failure case (CTLOG_new() returning NULL) was not usefully distinct from all of the other failure cases. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1407)
2016-08-05spelling fixes, just comments and readme.klemens
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
2016-08-05Removes CTLOG_new_null from the CT public APIRob Percival
This is an entirely useless function, given that CTLOG is publicly immutable. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1406)
2016-08-05Added appropriate OPENSSL_NO_STDIO to PKCS12 headerDániel Bakai
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-04Make DTLS1_BAD_VER work with DTLS_client_method()David Woodhouse
DTLSv1_client_method() is deprecated, but it was the only way to obtain DTLS1_BAD_VER support. The SSL_OP_CISCO_ANYCONNECT hack doesn't work with DTLS_client_method(), and it's relatively non-trivial to make it work without expanding the hack into lots of places. So deprecate SSL_OP_CISCO_ANYCONNECT with DTLSv1_client_method(), and make it work with SSL_CTX_set_{min,max}_proto_version(DTLS1_BAD_VER) instead. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-04Remove "lockit" from internal error-hash functionRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1389)
2016-08-04Limit status message sisze in ts_get_status_checkDr. Stephen Henson
Thanks to Shi Lei for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-04Constify some ASN1_OBJECT *obj input parametersFdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-04Constify inputs of two X509_LOOKUP_METHOD methodsFdaSilvaYY
... get_by_fingerprint() and get_by_alias() Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-04Constify input bufferFdaSilvaYY
of X509_NAME_add_entry_by_OBJ, X509_NAME_add_entry_by_NID, X509_NAME_ENTRY_create_by_NID Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-04Constify ASN1_INTEGER_get, ASN1_ENUMERATED_getFdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-04Prepare for 1.1.0-pre7-devMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-04Prepare for 1.1.0-pre6 releaseOpenSSL_1_1_0-pre6Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-01Constify some X509_CRL, X509_REQ functions.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-01Add DSA_bits() function.Dr. Stephen Henson
RT#4637 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-01Forgotten make updateRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-01Const the ex data stuff too to fix warningsRichard J. Moore
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-01Const EC_KEY_dupRichard J. Moore
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-31evp/evp_enc.c: make assert error message more readableAndy Polyakov
and add EVPerr(PARTIALLY_OVERLAPPED) Reviewed-by: Stephen Henson <steve@openssl.org>
2016-07-30Ignore the serial number for now and just do the rest.Richard J. Moore
Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1367)
2016-07-30Make some more X509 functions const.Richard J. Moore
Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1367)
2016-07-29Simplify and rename SSL_set_rbio() and SSL_set_wbio()Matt Caswell
SSL_set_rbio() and SSL_set_wbio() are new functions in 1.1.0 and really should be called SSL_set0_rbio() and SSL_set0_wbio(). The old implementation was not consistent with what "set0" means though as there were special cases around what happens if the rbio and wbio are the same. We were only ever taking one reference on the BIO, and checking everywhere whether the rbio and wbio are the same so as not to double free. A better approach is to rename the functions to SSL_set0_rbio() and SSL_set0_wbio(). If an existing BIO is present it is *always* freed regardless of whether the rbio and wbio are the same or not. It is therefore the callers responsibility to ensure that a reference is taken for *each* usage, i.e. one for the rbio and one for the wbio. The legacy function SSL_set_bio() takes both the rbio and wbio in one go and sets them both. We can wrap up the old behaviour in the implementation of that function, i.e. previously if the rbio and wbio are the same in the call to this function then the caller only needed to ensure one reference was passed. This behaviour is retained by internally upping the ref count. This commit was inspired by BoringSSL commit f715c423224. RT#4572 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-26Deprecate X509_LU_FAIL, X509_LU_RETRYDr. Stephen Henson
Instead of X509_LU_FAIL, X509_LU_RETRY use 0/1 for return values. RT#4577 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-26Use X509_LOOKUP_TYPE for lookup type consistently.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-26Move X509_LU_RETRY, X509_LU_FAILDr. Stephen Henson
X509_LU_RETRY and X509_LU_FAIL are not X509_OBJECT types so don't include them in the enum. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Discard BIO_set(BIO* bio) methodFdaSilvaYY
Simplify BIO init using OPENSSL_zalloc(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1261)
2016-07-25Make it possible for external code to set the certiciate proxy path lengthRichard Levitte
This adds the functions X509_set_proxy_pathlen(), which sets the internal pc path length cache for a given X509 structure, along with X509_get_proxy_pathlen(), which retrieves it. Along with the previously added X509_set_proxy_flag(), this provides the tools needed to manipulate all the information cached on proxy certificates, allowing external code to do what's necessary to have them verified correctly by the libcrypto code. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Add X509_STORE lock and unlock functionsRichard Levitte
Since there are a number of function pointers in X509_STORE that might lead to user code, it makes sense for them to be able to lock the store while they do their work. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Add setter and getter for X509_STORE's check_policyRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Add getters / setters for the X509_STORE_CTX and X509_STORE functionsRichard Levitte
We only add setters for X509_STORE function pointers except for the verify callback function. The thought is that the function pointers in X509_STORE_CTX are a cache for the X509_STORE functions. Therefore, it's preferable if the user makes the changes in X509_STORE before X509_STORE_CTX_init is called, and otherwise use the verify callback to override any results from OpenSSL's internal calculations. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-25Typo and comment fixFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1301)
2016-07-25Discard some unused typedefsFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1301)
2016-07-25Constify X509|X509_CRL|X509_REVOKED_get_extFdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Constify ... X509|X509_CRL|X509_REVOKED|_get_ext*()FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Constify ...FdaSilvaYY
X509_REVOKED_get0_extensions X509_check_private_key Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
2016-07-25Constify (X509|X509V3|X509_CRL|X509_REVOKED)_get_ext_d2i ...FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1300)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-27 08:14:25 +0000