summaryrefslogtreecommitdiffstats
path: root/ssl/ssltest.c
AgeCommit message (Collapse)Author
2015-05-26Fix ssltest to use 1024-bit DHE parametersEmilia Kasper
Also add more ciphersuite test coverage, and a negative test for 512-bit DHE. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 1ee85aab75d7c9f20058f781bfe9222323df08eb)
2015-05-20Only support >= 256-bit elliptic curves with ecdh_auto (server) or by ↵Emilia Kasper
default (client). Also reorder preferences to prefer prime curves to binary curves, and P-256 to everything else. The result: $ openssl s_server -named_curves "auto" This command will negotiate an ECDHE ciphersuite with P-256: $ openssl s_client This command will negotiate P-384: $ openssl s_client -curves "P-384" This command will not negotiate ECDHE because P-224 is disabled with "auto": $ openssl s_client -curves "P-224" Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-03-20Add DTLS support to ssltestDavid Woodhouse
Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 98b8cdd32277cea829c31034a53f2487f750615d) Conflicts: ssl/ssltest.c
2015-02-06Fix error handling in ssltestMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit ae632974f905c59176fa5f312826f8f692890b67)
2015-01-22Re-align some comments after running the reformat script.OpenSSL_1_0_2-post-reformatMatt Caswell
This should be a one off operation (subsequent invokation of the script should not move them) This commit is for the 1.0.2 changes Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Move more comments that confuse indentMatt Caswell
Conflicts: crypto/dsa/dsa.h demos/engines/ibmca/hw_ibmca.c ssl/ssl_locl.h Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22indent has problems with comments that are on the right hand side of a line.Matt Caswell
Sometimes it fails to format them very well, and sometimes it corrupts them! This commit moves some particularly problematic ones. Conflicts: crypto/bn/bn.h crypto/ec/ec_lcl.h crypto/rsa/rsa.h demos/engines/ibmca/hw_ibmca.c ssl/ssl.h ssl/ssl3.h Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Fix source where indent will not be able to copeMatt Caswell
Conflicts: apps/ciphers.c ssl/s3_pkt.c Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Further comment amendments to preserve formatting prior to source reformatMatt Caswell
(cherry picked from commit 4a7fa26ffd65bf36beb8d1cb8f29fc0ae203f5c5) Conflicts: crypto/x509v3/pcy_tree.c Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22mark all block comments that need format preserving so thatTim Hudson
indent will not alter them when reformatting comments (cherry picked from commit 1d97c8435171a7af575f73c526d79e1ef0ee5960) Conflicts: crypto/bn/bn_lcl.h crypto/bn/bn_prime.c crypto/engine/eng_all.c crypto/rc4/rc4_utl.c crypto/sha/sha.h ssl/kssl.c ssl/t1_lib.c Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-11-19New option no-ssl3-method which removes SSLv3_*methodDr. Stephen Henson
When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3 options for s_client/s_server/ssltest. When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3 options. We should document this somewhere, e.g. wiki, FAQ or manual page. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 3881d8106df732fc433d30446625dfa2396da42d)
2014-10-27Fix ssltest logic when some protocols are compiled out.Emilia Kasper
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Geoff Thorpe <geoff@openssl.org> (cherry picked from commit fd28a41ec899eb8749e21d11441fd4df35ed9a07) Conflicts: ssl/ssltest.c
2014-09-09RT3506: typo's in ssltestKurt Cancemi
Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 4eadd11cd97ad359a2207e8e554d9fc84fce1110)
2014-08-28Fix comments, add new test.Dr. Stephen Henson
Fix comments in ssltest.c: return value of 0 now means extension is omitted and add_cb is not called for servers if the corresponding extension is absent in ClientHello. Test add_cb is not called if extension is not received. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit f47e203975133ddbae3cde20c8c3c0516f62066c)
2014-08-28Rename some callbacks, fix alignment.Dr. Stephen Henson
Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 0cfefe4b6dcc6947c236b0f10a7f9e2f02273075)
2014-08-28Use consistent function naming.Dr. Stephen Henson
Instead of SSL_CTX_set_custom_cli_ext and SSL_CTX_set_custom_srv_ext use SSL_CTX_add_client_custom_ext and SSL_CTX_add_server_custom_ext. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 8cafe9e8bfcc99d12adf083c61411955995668c4)
2014-08-28New extension callback features.Dr. Stephen Henson
Support separate parse and add callback arguments. Add new callback so an application can free extension data. Change return value for send functions so < 0 is an error 0 omits extension and > 0 includes it. This is more consistent with the behaviour of other functions in OpenSSL. Modify parse_cb handling so <= 0 is an error. Make SSL_CTX_set_custom_cli_ext and SSL_CTX_set_custom_cli_ext argument order consistent. NOTE: these changes WILL break existing code. Remove (now inaccurate) in line documentation. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 33f653adf3bff5b0795e22de1f54b7c5472252d0)
2014-08-28Callback revision.Dr. Stephen Henson
Use "parse" and "add" for function and callback names instead of "first" and "second". Change arguments to callback so the extension type is unsigned int and the buffer length is size_t. Note: this *will* break existing code. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit de2a9e38f39eacc2e052d694f5b5fa5b7e734abc)
2014-07-04Remove all RFC5878 code.Dr. Stephen Henson
Remove RFC5878 code. It is no longer needed for CT and has numerous bugs.
2014-06-11Enable multi-block support by default.Andy Polyakov
(cherry picked from commit 77a27a5066e8c0975d78be635ed356749a6f16db)
2014-02-09More cleanup.Ben Laurie
(cherry picked from commit 5eda213ebe382009c2f37a8eade5cbcdae6017ed) Conflicts: apps/s_client.c apps/s_server.c
2014-02-09Make it build.Ben Laurie
(cherry picked from commit a6a48e87bc469f37ed1c53d0e4d22faaa0a5adf3) Conflicts: ssl/s3_clnt.c ssl/t1_lib.c
2014-02-09Reverting 1.0.2-only changes supporting the prior authz RFC5878-based tests ↵Scott Deboy
from commit 835d104f46c4448a27844a9309de456c7972a943
2014-02-08Don't break out of the custom extension callback loop - continue insteadScott Deboy
The contract for custom extension callbacks has changed - all custom extension callbacks are triggered
2014-02-08Fix whitespace, new-style comments.Ben Laurie
2014-02-08Re-add alert variables removed during rebaseScott Deboy
Whitespace fixes (cherry picked from commit e9add063b50e8a460d5636055156d2760c2fe29f) Conflicts: ssl/s3_clnt.c
2014-02-08Update custom TLS extension and supplemental data 'generate' callbacks to ↵Scott Deboy
support sending an alert. If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake. Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate. (cherry picked from commit ac20719d994729970eb3b775c7bffa81f0e9f960) Conflicts: ssl/t1_lib.c
2014-02-08Add callbacks supporting generation and retrieval of supplemental data ↵Scott Deboy
entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation. (cherry picked from commit 36086186a9b90cdad0d2cd0a598a10f03f8f4bcc) Conflicts: Configure apps/s_client.c apps/s_server.c ssl/ssl.h ssl/ssl3.h ssl/ssltest.c
2013-09-13Add tests for ALPN functionality.Adam Langley
Cherry-picked from a898936218bc279b5d7cdf76d58a25e7a2d419cb.
2013-07-03Trying cherrypick:Trevor
Add support for arbitrary TLS extensions. Contributed by Trevor Perrin. Conflicts: CHANGES ssl/ssl.h ssl/ssltest.c test/testssl Fix compilation due to #endif. Cherrypicking more stuff. Cleanup of custom extension stuff. serverinfo rejects non-empty extensions. Omit extension if no relevant serverinfo data. Improve error-handling in serverinfo callback. Cosmetic cleanups. s_client documentation. s_server documentation. SSL_CTX_serverinfo documentation. Cleaup -1 and NULL callback handling for custom extensions, add tests. Cleanup ssl_rsa.c serverinfo code. Whitespace cleanup. Improve comments in ssl.h for serverinfo. Whitespace. Cosmetic cleanup. Reject non-zero-len serverinfo extensions. Whitespace. Make it build. Conflicts: test/testssl
2013-02-11Fix in ssltest is no-ssl2 configuredDr. Stephen Henson
(cherry picked from commit cbf9b4aed3e209fe8a39e1d6f55aaf46d1369dc4)
2012-12-30stop warning when compiling with no-compDr. Stephen Henson
2012-06-07Rearrange and test authz extension.Ben Laurie
2012-06-03Reduce version skew: trivia (I hope).Ben Laurie
2011-12-14PR: 1794Dr. Stephen Henson
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> Reviewed by: steve Remove unnecessary code for srp and to add some comments to s_client. - the callback to provide a user during client connect is no longer necessary since rfc 5054 a connection attempt with an srp cipher and no user is terminated when the cipher is acceptable - comments to indicate in s_client the (non-)usefulness of th primalaty tests for non known group parameters.
2011-06-06Backport from HEAD:Dr. Stephen Henson
New option to disable characteristic two fields in EC code. Make no-ec2m work on Win32 build.
2011-05-19add FIPS support to ssl: doesn't do anything on this branch yet as there is ↵Dr. Stephen Henson
no FIPS compilation support
2011-03-16Add SRP.Ben Laurie
2011-01-26FIPS_allow_md5() no longer exists and is no longer requiredDr. Stephen Henson
2010-06-15Fix warnings (From HEAD, original patch by Ben).Dr. Stephen Henson
2010-01-24PR: 2153, 2125Dr. Stephen Henson
Submitted by: steve@openssl.org The original fix for PR#2125 broke compilation on some Unixware platforms: revert and make conditional on VMS.
2010-01-14PR: 2125Dr. Stephen Henson
Submitted by: "Alon Bar-Lev" <alon.barlev@gmail.com> Fix gcc-aix compilation issue.
2009-01-07Updatde from stable branch.Dr. Stephen Henson
2008-10-12Type-checked (and modern C compliant) OBJ_bsearch.Ben Laurie
2008-08-06Remove the dual-callback scheme for numeric and pointer thread IDs,Geoff Thorpe
deprecate the original (numeric-only) scheme, and replace with the CRYPTO_THREADID object. This hides the platform-specifics and should reduce the possibility for programming errors (where failing to explicitly check both thread ID forms could create subtle, platform-specific bugs). Thanks to Bodo, for invaluable review and feedback.
2008-07-03Revert my earlier CRYPTO_THREADID commit, I will commit a reworkedGeoff Thorpe
version some time soon.
2008-03-28There was a need to support thread ID types that couldn't be reliably castGeoff Thorpe
to 'unsigned long' (ie. odd platforms/compilers), so a pointer-typed version was added but it required portable code to check *both* modes to determine equality. This commit maintains the availability of both thread ID types, but deprecates the type-specific accessor APIs that invoke the callbacks - instead a single type-independent API is used. This simplifies software that calls into this interface, and should also make it less error-prone - as forgetting to call and compare *both* thread ID accessors could have led to hard-to-debug/infrequent bugs (that might only affect certain platforms or thread implementations). As the CHANGES note says, there were corresponding deprecations and replacements in the thread-related functions for BN_BLINDING and ERR too.
2007-09-21Implement the Opaque PRF Input TLS extensionBodo Möller
(draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and bugfixes on the way. In particular, this fixes the buffer bounds checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext(). Note that the opaque PRF Input TLS extension is not compiled by default; see CHANGES.
2006-03-12use BIO_snprintf() instead of snprintf + use BIO_FP_TEXT for text outputNils Larsch
Submitted by: Gisle Vanem
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-09 08:23:02 +0000