summaryrefslogtreecommitdiffstats
path: root/ssl/ssl.h
AgeCommit message (Collapse)Author
2014-11-25Corrected comments in ssl.h about SSLv23_method and friendsMatt Caswell
PR#3574 Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 3a0765882c4b3b67960b7efb203570764dd4ed29)
2014-11-19New option no-ssl3-method which removes SSLv3_*methodDr. Stephen Henson
When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3 options for s_client/s_server/ssltest. When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3 options. We should document this somewhere, e.g. wiki, FAQ or manual page. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 3881d8106df732fc433d30446625dfa2396da42d) Conflicts: util/mkdef.pl
2014-10-21Fix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.Bodo Moeller
Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-10-15Support TLS_FALLBACK_SCSV.Bodo Moeller
Reviewed-by: Rich Salz <rsalz@openssl.org>
2014-08-06Check SRP parameters early.Dr. Stephen Henson
Check SRP parameters when they are received so we can send back an appropriate alert. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2014-07-24Add conditional unit testing interface.Dr. Stephen Henson
Don't call internal functions directly call them through SSL_test_functions(). This also makes unit testing work on Windows and platforms that don't export internal functions from shared libraries. By default unit testing is not enabled: it requires the compile time option "enable-unit-test". Reviewed-by: Geoff Thorpe <geoff@openssl.org> (cherry picked from commit e0fc7961c4fbd27577fb519d9aea2dc788742715) Conflicts: ssl/Makefile util/mkdef.pl
2014-06-09SRP ciphersuite correction.Dr. Stephen Henson
SRP ciphersuites do not have no authentication. They have authentication based on SRP. Add new SRP authentication flag and cipher string. (cherry picked from commit a86b88acc373ac1fb0ca709a5fb8a8fa74683f67)
2014-06-01Option to disable padding extension.Dr. Stephen Henson
Add TLS padding extension to SSL_OP_ALL so it is used with other "bugs" options and can be turned off. This replaces SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG which is an ancient option referring to SSLv2 and SSLREF. PR#3336
2014-03-10typoDr. Stephen Henson
(cherry picked from commit a029788b0e0c19cee4007cc1f73201cf2c13addf)
2014-01-04Restore SSL_OP_MSIE_SSLV2_RSA_PADDINGDr. Stephen Henson
The flag SSL_OP_MSIE_SSLV2_RSA_PADDING hasn't done anything since OpenSSL 0.9.7h but deleting it will break source compatibility with any software that references it. Restore it but #define to zero. (cherry picked from commit b17d6b8d1d49fa4732deff17cfd1833616af0d9c)
2013-10-19Merge branch 'no_gmt_unix_time' of git://github.com/nmathewson/openssl into ↵Ben Laurie
OpenSSL_1_0_1-stable
2013-10-09Control sending time with SSL_SEND_{CLIENT,SERVER}RANDOM_MODENick Mathewson
(I'd rather use an option, but it appears that the options field is full.) Now, we send the time in the gmt_unix_time field if the appropriate one of these mode options is set, but randomize the field if the flag is not set.
2013-09-16Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X.Rob Stradling
OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers.
2013-02-04Fix error codes.Dr. Stephen Henson
2012-06-08Reduce version skew.Ben Laurie
2012-04-25Change value of SSL_OP_NO_TLSv1_1 to avoid clash with SSL_OP_ALL andDr. Stephen Henson
OpenSSL 1.0.0. Add CHANGES entry noting the consequences.
2012-04-18correct error codeDr. Stephen Henson
2012-02-22ABI compliance fixes.Dr. Stephen Henson
Move new structure fields to end of structures. Import library codes from 1.0.0 and recreate new ones.
2012-02-10Submitted by: Eric Rescorla <ekr@rtfm.com>Dr. Stephen Henson
Fix encoding of use_srtp extension to be compliant with RFC5764
2012-01-04Only allow one SGC handshake restart for SSL/TLS. (CVE-2011-4619)Dr. Stephen Henson
2011-12-31PR: 2658Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Support for TLS/DTLS heartbeats.
2011-12-23typoDr. Stephen Henson
2011-12-23delete unimplemented function from header file, update ordinalsDr. Stephen Henson
2011-12-22remove prototype for deleted SRP functionDr. Stephen Henson
2011-12-22New ctrl values to clear or retrieve extra chain certs from an SSL_CTX.Dr. Stephen Henson
New function to retrieve compression method from SSL_SESSION structure. Delete SSL_SESSION_get_id_len and SSL_SESSION_get0_id functions as they duplicate functionality of SSL_SESSION_get_id. Note: these functions have never appeared in any release version of OpenSSL.
2011-12-14PR: 1794Dr. Stephen Henson
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Remove unnecessary code for srp and to add some comments to s_client. - the callback to provide a user during client connect is no longer necessary since rfc 5054 a connection attempt with an srp cipher and no user is terminated when the cipher is acceptable - comments to indicate in s_client the (non-)usefulness of th primalaty tests for non known group parameters.
2011-12-13Remove redundant TLS exporter.Ben Laurie
2011-12-02Fix exporter.Ben Laurie
2011-11-25PR: 1794Dr. Stephen Henson
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Make SRP conformant to rfc 5054. Changes are: - removal of the addition state after client hello - removal of all pre-rfc srp alert ids - sending a fatal alert when there is no srp extension but when the server wants SRP - removal of unnecessary code in the client.
2011-11-15Add TLS exporter.Ben Laurie
2011-11-15Add DTLS-SRTP.Ben Laurie
2011-11-13Add Next Protocol Negotiation.Ben Laurie
2011-09-05Fix session handling.Bodo Möller
2011-09-05Fix d2i_SSL_SESSION.Bodo Möller
2011-08-04Backport GCM support from HEAD.Dr. Stephen Henson
2011-07-25Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support andDr. Stephen Henson
prohibit use of these ciphersuites for TLS < 1.2
2011-05-12Process signature algorithms during TLS v1.2 client authentication.Dr. Stephen Henson
Make sure message is long enough for signature algorithms. (backport from HEAD).
2011-05-11Backport TLS v1.2 support from HEAD.Dr. Stephen Henson
This includes TLS v1.2 server and client support but at present client certificate support is not implemented.
2011-05-11Initial "opaque SSL" framework. If an application defines OPENSSL_NO_SSL_INTERNDr. Stephen Henson
all ssl related structures are opaque and internals cannot be directly accessed. Many applications will need some modification to support this and most likely some additional functions added to OpenSSL. The advantage of this option is that any application supporting it will still be binary compatible if SSL structures change. (backport from HEAD).
2011-03-16Fix SRP error codes (from HEAD).Dr. Stephen Henson
2011-03-16Add SRP.Ben Laurie
2010-08-27oops, revert previous patchDr. Stephen Henson
2010-08-27PR: 1833Dr. Stephen Henson
Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de> Fix other cases not covered by original patch.
2010-08-26PR: 1833Dr. Stephen Henson
Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de> Support for abbreviated handshakes when renegotiating.
2010-07-18PR: 1830Dr. Stephen Henson
Submitted By: Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson Support for RFC5705 key extractor.
2010-06-27Backport TLS v1.1 support from HEAD, ssl/ changesDr. Stephen Henson
2010-01-06Updates to conform with draft-ietf-tls-renegotiation-03.txt:Dr. Stephen Henson
1. Add provisional SCSV value. 2. Don't send SCSV and RI at same time. 3. Fatal error is SCSV received when renegotiating.
2010-01-05compress_meth should be unsignedDr. Stephen Henson
2010-01-01Client side compression algorithm sanity checks: ensure old compressionDr. Stephen Henson
algorithm matches current and give error if compression is disabled and server requests it (shouldn't happen unless server is broken).
2010-01-01Compression handling on session resume was badly broken: it alwaysDr. Stephen Henson
used compression algorithms in client hello (a legacy from when the compression algorithm wasn't serialized with SSL_SESSION).
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-27 15:33:49 +0000