summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2008-08-05Fix signed/unsigned warning.Geoff Thorpe
2008-08-04Fix error codes for memory-saving patch.Bodo Möller
Also, get rid of compile-time switch OPENSSL_NO_RELEASE_BUFFERS because it was rather pointless (the new behavior has to be explicitly requested by setting SSL_MODE_RELEASE_BUFFERS anyway).
2008-07-04Avoid warnings with -pedantic, specifically:Dr. Stephen Henson
Conversion between void * and function pointer. Value computed not used. Signed/unsigned argument.
2008-07-03Revert my earlier CRYPTO_THREADID commit, I will commit a reworkedGeoff Thorpe
version some time soon.
2008-06-05Update from stable branch.Dr. Stephen Henson
2008-06-04Remove test fprintf.Dr. Stephen Henson
2008-06-04Compilation option to use a specific ssl client auth engine automatically.Dr. Stephen Henson
2008-06-04More type-checking.Ben Laurie
2008-06-03Add support for client cert engine setting in s_client app.Dr. Stephen Henson
Add appropriate #ifdefs round client cert functions in headers.
2008-06-03Prevent signed/unsigned warning on VC++Dr. Stephen Henson
2008-06-03Memory saving patch.Ben Laurie
2008-06-01Release engine reference when calling SSL_CTX_free().Dr. Stephen Henson
2008-06-01Allow ENGINE client cert callback to specify a set of other certs, forDr. Stephen Henson
the rest of the certificate chain. Currently unused.
2008-06-01Update error codes.Dr. Stephen Henson
2008-06-01Add client cert engine to SSL routines.Dr. Stephen Henson
2008-06-01Update error codes, move typedef of SSL, SSL_CTX to ossl_typ.hDr. Stephen Henson
2008-05-28From HEAD:Bodo Möller
Fix flaw if 'Server Key exchange message' is omitted from a TLS handshake which could lead to a cilent crash as found using the Codenomicon TLS test suite (CVE-2008-1672) Reviewed by: openssl-security@openssl.org Obtained from: mark@awe.com
2008-05-28From HEAD:Bodo Möller
Fix double-free in TLS server name extensions which could lead to a remote crash found by Codenomicon TLS test suite (CVE-2008-0891) Reviewed by: openssl-security@openssl.org Obtained from: jorton@redhat.com
2008-05-26LHASH revamp. make depend.Ben Laurie
2008-05-26Reword comment to be much shorter to stop other people from complainingLutz Jänicke
about "overcommenting".
2008-05-23Clear error queue when starting SSL_CTX_use_certificate_chain_fileLutz Jänicke
PR: 1417, 1513 Submitted by: Erik de Castro Lopo <mle+openssl@mega-nerd.com>
2008-04-30Update from stable branch.Dr. Stephen Henson
2008-04-29Update from stable branch.Dr. Stephen Henson
2008-04-29Oops!Dr. Stephen Henson
2008-04-29Update from stable branch.Dr. Stephen Henson
2008-04-29Update from stable branch.Dr. Stephen Henson
2008-04-25Don't send zero length session ID if stateless session resupmtion isDr. Stephen Henson
successful. Check be seeing if there is a cache hit.
2008-04-25Disable debugging fprintf.Dr. Stephen Henson
2008-03-28There was a need to support thread ID types that couldn't be reliably castGeoff Thorpe
to 'unsigned long' (ie. odd platforms/compilers), so a pointer-typed version was added but it required portable code to check *both* modes to determine equality. This commit maintains the availability of both thread ID types, but deprecates the type-specific accessor APIs that invoke the callbacks - instead a single type-independent API is used. This simplifies software that calls into this interface, and should also make it less error-prone - as forgetting to call and compare *both* thread ID accessors could have led to hard-to-debug/infrequent bugs (that might only affect certain platforms or thread implementations). As the CHANGES note says, there were corresponding deprecations and replacements in the thread-related functions for BN_BLINDING and ERR too.
2008-03-22Update dependencies.Dr. Stephen Henson
2008-03-16Fix a variety of warnings generated by some elevated compiler-fascism,Geoff Thorpe
OPENSSL_NO_DEPRECATED, etc. Steve, please double-check the CMS stuff...
2008-03-12And so it begins...Dr. Stephen Henson
Initial support for CMS. Add zlib compression BIO. Add AES key wrap implementation. Generalize S/MIME MIME code to support CMS and/or PKCS7.
2008-01-05Fix unsigned/signed warnings in ssl.Andy Polyakov
2007-12-14Initialize sigsize.Dr. Stephen Henson
2007-11-03Fix from stable branch.Dr. Stephen Henson
2007-10-26Fix duplicate error codes.Dr. Stephen Henson
2007-10-261. Changes for s_client.c to make it return non-zero exit code in caseDr. Stephen Henson
of handshake failure 2. Changes to x509_certificate_type function (crypto/x509/x509type.c) to make it recognize GOST certificates as EVP_PKT_SIGN|EVP_PKT_EXCH (required for s3_srvr to accept GOST client certificates). 3. Changes to EVP - adding of function EVP_PKEY_CTX_get0_peerkey - Make function EVP_PKEY_derive_set_peerkey work for context with ENCRYPT operation, because we use peerkey field in the context to pass non-ephemeral secret key to GOST encrypt operation. - added EVP_PKEY_CTRL_SET_IV control command. It is really GOST-specific, but it is used in SSL code, so it has to go in some header file, available during libssl compilation 4. Fix to HMAC to avoid call of OPENSSL_cleanse on undefined data 5. Include des.h if KSSL_DEBUG is defined into some libssl files, to make debugging output which depends on constants defined there, work and other KSSL_DEBUG output fixes 6. Declaration of real GOST ciphersuites, two authentication methods SSL_aGOST94 and SSL_aGOST2001 and one key exchange method SSL_kGOST 7. Implementation of these methods. 8. Support for sending unsolicited serverhello extension if GOST ciphersuite is selected. It is require for interoperability with CryptoPro CSP 3.0 and 3.6 and controlled by SSL_OP_CRYPTOPRO_TLSEXT_BUG constant. This constant is added to SSL_OP_ALL, because it does nothing, if non-GOST ciphersuite is selected, and all implementation of GOST include compatibility with CryptoPro. 9. Support for CertificateVerify message without length field. It is another CryptoPro bug, but support is made unconditional, because it does no harm for draft-conforming implementation. 10. In tls1_mac extra copy of stream mac context is no more done. When I've written currently commited code I haven't read EVP_DigestSignFinal manual carefully enough and haven't noticed that it does an internal digest ctx copying. This implementation was tested against 1. CryptoPro CSP 3.6 client and server 2. Cryptopro CSP 3.0 server
2007-10-18Fix from stable branch.Dr. Stephen Henson
2007-10-17Don't let DTLS ChangeCipherSpec increment handshake sequence number.Andy Polyakov
PR: 1587
2007-10-17Don't lookup zero length session ID.Dr. Stephen Henson
PR: 1591
2007-10-17Fix from stable branch.Dr. Stephen Henson
2007-10-14Make ssl compile [from 098-stable, bug is masked by default].Andy Polyakov
2007-10-13Fix warnings in d1_both.c [from 0.9.8-stable].Andy Polyakov
2007-10-13DTLS fixes from 0.9.8-stable.Andy Polyakov
2007-10-09Respect cookie length set by app_gen_cookie_cb.Andy Polyakov
Submitted by: Alex Lam
2007-10-09Make DTLS1 record layer MAC calculation RFC compliant.Andy Polyakov
Submitted by: Alex Lam
2007-10-05Prohibit RC4 in DTLS.Andy Polyakov
2007-10-04Off by one fix from stable branch.Dr. Stephen Henson
2007-10-01Oops! This was erroneously left out commit #16632.Andy Polyakov
2007-09-30Basic idea behind explicit IV is to make it unpredictable for attacker.Andy Polyakov
Until now it was xor between CBC residue and 1st block from last datagram, or in other words still predictable.
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-05 08:00:53 +0000