summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2002-12-29Fix wrong handling of session ID in SSLv2 client code.Lutz Jänicke
PR: 377
2002-12-29make updateRichard Levitte
2002-12-24Some more adjustmentsLutz Jänicke
Submitted by: Jeffrey Altman <jaltman@columbia.edu>, "Kenneth R. Robinette" <support@securenetterm.com>
2002-12-21Stop a possible memory leak.Richard Levitte
(I wonder why s2_connect() handles the initial buffer allocation slightly differently...) PR: 416
2002-12-20Fix Kerberos5/SSL interactionLutz Jänicke
Submitted by: "Kenneth R. Robinette" <support@securenetterm.com> Reviewed by: PR:
2002-12-19We stupidly had a separate LIBKRB5 variable for KRB5 library dependencies,Richard Levitte
and then didn't support it very well. And that when there already is a useful variable for exactly this kind of thing; EX_LIBS...
2002-12-19If _XOPEN_SOURCE_EXTENDED or _XOPEN_SOURCE are defined, _POSIX_C_SOURCE getsRichard Levitte
defined in DECC$TYPES.H. If _POSIX_C_SOURCE is defined, certain types do not get defined (u_char, u_int, ...). DECC.H gets included by assert.h and others. Now, in6.h uses the types u_char, u_int and so on, and gets included as part of other header inclusions, and will of course fail because of the missing types. On the other hand, _XOPEN_SOURCE_EXTENDED is needed to get gethostname() properly declared... Solution: define _XOPEN_SOURCE_EXTENDED much later, so DECC$TYPES.H has a chance to be included *first*, so the otherwise missing types get defined properly. Personal: *mumble* *mumble*
2002-12-16Protect loading routines with a lock.Richard Levitte
PR: 373
2002-12-08This is a first-cut at improving the callback mechanisms used inGeoff Thorpe
key-generation and prime-checking functions. Rather than explicitly passing callback functions and caller-defined context data for the callbacks, a new structure BN_GENCB is defined that encapsulates this; a pointer to the structure is passed to all such functions instead. This wrapper structure allows the encapsulation of "old" and "new" style callbacks - "new" callbacks return a boolean result on the understanding that returning FALSE should terminate keygen/primality processing. The BN_GENCB abstraction will allow future callback modifications without needing to break binary compatibility nor change the API function prototypes. The new API functions have been given names ending in "_ex" and the old functions are implemented as wrappers to the new ones. The OPENSSL_NO_DEPRECATED symbol has been introduced so that, if defined, declaration of the older functions will be skipped. NB: Some openssl-internal code will stick with the older callbacks for now, so appropriate "#undef" logic will be put in place - this is in case the user is *building* openssl (rather than *including* its headers) with this symbol defined. There is another change in the new _ex functions; the key-generation functions do not return key structures but operate on structures passed by the caller, the return value is a boolean. This will allow for a smoother transition to having key-generation as "virtual function" in the various ***_METHOD tables.
2002-12-08Fix a warning, and do some constification as a lucky side-effect :-)Geoff Thorpe
2002-12-08Since it's defined in draft-ietf-tls-compression-04.txt, let's makeRichard Levitte
ZLIB a known compression method, with the identity 1.
2002-12-04gethostname() is more a BSD feature than an XOPEN one.Richard Levitte
PR: 379
2002-12-02define USE_SOCKETS so sys/param.h gets included (and thusly, MAXHOSTNAMELENRichard Levitte
gets defined). PR: 371
2002-11-29A few more memset()s converted to OPENSSL_cleanse().Richard Levitte
I *think* I got them all covered by now, bu please, if you find any more, tell me and I'll correct it. PR: 343
2002-11-28Have all tests use EXIT() to exit rather than exit(), since the latter doesn'tRichard Levitte
always give the expected result on some platforms.
2002-11-28Cleanse memory using the new OPENSSL_cleanse() function.Richard Levitte
I've covered all the memset()s I felt safe modifying, but may have missed some.
2002-11-26Small bugfixes to the KSSL implementation.Richard Levitte
PR: 349
2002-11-22Typo. OPENSSL_NO_ECDH, not NO_OPENSSL_ECDHRichard Levitte
2002-11-20Fix bug introduced by the attempt to fix client side external sessionLutz Jänicke
caching (#288): now internal caching failed (#351): Make sure, that cipher_id is set before comparing. Submitted by: Reviewed by: PR: 288 (and 351)
2002-11-19allocate bio_err before memory debugging is enabled to avoid memory leaksBodo Möller
(we can't release it before the CRYPTO_mem_leaks() call!) Submitted by: Nils Larsch
2002-11-15WinCE patchesRichard Levitte
2002-11-15The pointer to the cipher object is not yet set, when session was reloadedLutz Jänicke
from external cache (using d2i_SSL_SESSION). Perform comparison based on the cipher's id instead. Submitted by: Steve Haslam <araqnid@innocent.com> Reviewed by: PR: 288
2002-11-15We need to read one more byte of the REQUEST-CERTIFICATE message.Richard Levitte
PR: 300
2002-11-13Security fixes brought forward from 0.9.7.Ben Laurie
2002-11-05avoid Purify warningsBodo Möller
Submitted by: Nils Larsch
2002-11-05fix typoBodo Möller
2002-10-31Remove all referenses to RSAref, since that's been gone for more thanRichard Levitte
a year.
2002-10-29Sun has agreed to removing the covenant language from most files.Bodo Möller
Submitted by: Sheueling Chang <Sheueling.Chang@Sun.COM>
2002-10-29Correct and enhance the behaviour of "internal" session caching as itGeoff Thorpe
relates to SSL_CTX flags and the use of "external" session caching. The existing flag, "SSL_SESS_CACHE_NO_INTERNAL_LOOKUP" remains but is supplemented with a complimentary flag, "SSL_SESS_CACHE_NO_INTERNAL_STORE". The bitwise OR of the two flags is also defined as "SSL_SESS_CACHE_NO_INTERNAL" and is the flag that should be used by most applications wanting to implement session caching *entirely* by its own provided callbacks. As the documented behaviour contradicted actual behaviour up until recently, and since that point behaviour has itself been inconsistent anyway, this change should not introduce any compatibility problems. I've adjusted the relevant documentation to elaborate about how this works. Kudos to "Nadav Har'El" <nyh@math.technion.ac.il> for diagnosing these anomalies and testing this patch for correctness. PR: 311
2002-10-28increase permissible message length so that we can handleBodo Möller
CertificateVerify for 4096 bit RSA signatures
2002-10-15Typos.Richard Levitte
PR: 189
2002-10-15Typos.Richard Levitte
PR: 189
2002-10-14makedepend complains when a header file is included more than once inRichard Levitte
the same source file.
2002-10-10TypoRichard Levitte
2002-10-10RFC 2712 redefines the codes for use of Kerberos 5 in SSL/TLS.Richard Levitte
PR: 189
2002-10-09Use double dashes so makedepend doesn't misunderstand the flags weRichard Levitte
give it. For 0.9.7 and up, that means util/domd needs to remove those double dashes from the argument list when gcc is used to find the dependencies.
2002-09-26fix more race conditionsBodo Möller
Submitted by: "Patrick McCormick" <patrick@tellme.com> PR: 262
2002-09-25Add missing brackets.Lutz Jänicke
Submitted by: "Chris Brook" <cbrook@v-one.com>
2002-09-25really fix race conditionsBodo Möller
Submitted by: "Patrick McCormick" <patrick@tellme.com> PR: 262 PR: 291
2002-09-23really fix race conditionBodo Möller
PR: 262
2002-09-19there is no minimum length for session IDsBodo Möller
PR: 274
2002-09-19fix race conditionBodo Möller
PR: 262
2002-08-16Reorder cleanup sequence in SSL_CTX_free() to leave ex_data for remove_cb().Lutz Jänicke
Submitted by: Reviewed by: PR: 212
2002-08-15use correct function code in error messageBodo Möller
2002-08-15Sometimes, the value of the variable containing the compiler call canRichard Levitte
become rather large. This becomes a problem when the default 1024 character large buffer that WRITE uses isn't enough. WRITE/SYMBOL uses a 2048 byte large buffer instead.
2002-08-14Instead of returning errors when certain flags are unusable, just ignore them.Richard Levitte
That will make the test go through even if DH (or in some cases ECDH) aren't built into OpenSSL. PR: 216, part 2
2002-08-12remove commentBodo Möller
Submitted by: Douglas Stebila
2002-08-12remove debug messagesBodo Möller
Submitted by: Douglas Stebila
2002-08-12fix commentBodo Möller
Submitted by: Douglas Stebila
2002-08-12get rid of EVP_PKEY_ECDSA (now we have EVP_PKEY_EC instead)Bodo Möller
Submitted by: Nils Larsch
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-07 21:06:55 +0000