Rich Salz [Mon, 26 Oct 2015 20:00:23 +0000 (16:00 -0400)]
Move crypto/threads to demo/threads
Reviewed-by: Richard Levitte <levitte@openssl.org>
Ben Laurie [Sat, 24 Oct 2015 17:37:12 +0000 (18:37 +0100)]
Probably fix travis (wine build).
Reviewed-by: Stephen Henson <steve@openssl.org>
Ben Laurie [Sat, 3 Oct 2015 15:43:21 +0000 (16:43 +0100)]
Improve make depend.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Ben Laurie [Sat, 3 Oct 2015 15:43:21 +0000 (16:43 +0100)]
Fix undeclared variable warnings.
Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 20:00:27 +0000 (22:00 +0200)]
Remove useless code
RT#4081
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 12:50:27 +0000 (14:50 +0200)]
Check memory allocation
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 12:41:09 +0000 (14:41 +0200)]
Fix references to various RFCs
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 12:40:42 +0000 (14:40 +0200)]
Fix typos
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 12:39:58 +0000 (14:39 +0200)]
Set salt length after the malloc has succeeded
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 12:38:57 +0000 (14:38 +0200)]
Fix memory leaks and other mistakes on errors
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Thu, 8 Oct 2015 12:37:21 +0000 (14:37 +0200)]
Replace malloc+strlcpy with strdup
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Fri, 2 Oct 2015 13:16:08 +0000 (15:16 +0200)]
Do not treat 0 return value from BIO_get_fd() as error
0 is a valid file descriptor.
RT#4068
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Alessandro Ghedini [Fri, 23 Oct 2015 15:55:27 +0000 (17:55 +0200)]
Remove bugs/ and crypto/threads/
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Adam Eijdenberg [Mon, 19 Oct 2015 18:16:25 +0000 (11:16 -0700)]
Clarify return values for EVP_DigestVerifyFinal.
Previous language was unclear. New language isn't pretty but I believe
it is more accurate.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Thu, 22 Oct 2015 21:45:45 +0000 (23:45 +0200)]
Only include SRP headers when OPENSSL_NO_SRP is undefined
[fixes github issue #447]
Reviewed-by: Tim Hudson <tjh@openssl.org>
Richard Levitte [Thu, 22 Oct 2015 15:33:47 +0000 (17:33 +0200)]
Make Configure die when unsupported options are given
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 22 Oct 2015 15:09:14 +0000 (17:09 +0200)]
Add an explicit list of options that can be disabled, enabled, ...
Configure has, so far, had no control at all of which 'no-' options it
can be given. This means that, for example, someone could configure
with something absurd like 'no-stack' and then watch the build crumble
to dust... or file a bug report.
This introduces some sanity into the possible choices.
The added list comes from looking for the explicit ones used in
Configure, and from grepping after OPENSSL_NO_ in all source files.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Mon, 19 Oct 2015 18:53:14 +0000 (20:53 +0200)]
make update
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Mon, 19 Oct 2015 03:24:16 +0000 (05:24 +0200)]
Don't forget to load the CT error strings
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Mon, 19 Oct 2015 02:20:01 +0000 (04:20 +0200)]
Handle CT error macros separately
Because the default error macro generator assumes the header file with
error macros is in include/openssl and therefore generates a C file
with error texts that include <openssl/{name}.h>, we need to generate
the error macros and texts for CT separately, since the CT module
doesn't follow the default criteria.
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Wed, 21 Oct 2015 13:40:15 +0000 (14:40 +0100)]
Don't use SSLv23_server_method in an example
The function SSLv23_server_method() is an old name. New code should use
TLS_server_method() instead. Therefore don't use SSLv23_server_method() in
an example in the docs.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Wed, 21 Oct 2015 09:00:24 +0000 (10:00 +0100)]
Avoid undefined behaviour in PACKET_buf_init
Change the sanity check in PACKET_buf_init to check for excessive length
buffers, which should catch the interesting cases where len has been cast
from a negative value whilst avoiding any undefined behaviour.
RT#4094
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Sun, 18 Oct 2015 19:31:21 +0000 (21:31 +0200)]
ct_locl.h moved, reflect it in crypto/ct/Makefile
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Sun, 18 Oct 2015 06:59:51 +0000 (08:59 +0200)]
make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Sun, 18 Oct 2015 06:59:00 +0000 (08:59 +0200)]
Add crypto/include/internal to the directories to scan for stack declarations
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Sun, 18 Oct 2015 06:57:37 +0000 (08:57 +0200)]
Because ct_locl.h is used between modules, move it to internal headers
Rename it to ct_int.h
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sat, 17 Oct 2015 23:16:23 +0000 (00:16 +0100)]
Move auto Host adding to query_responder
Check for Host header in query_responder instead of process_responder. This
also fixes a memory leak in the old code if the headers was NULL.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Dr. Stephen Henson [Sat, 17 Oct 2015 23:04:10 +0000 (00:04 +0100)]
Fix memory leak with -issuer option.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Dr. Stephen Henson [Sat, 17 Oct 2015 23:54:13 +0000 (00:54 +0100)]
set string type when embedding
Reviewed-by: Tim Hudson <tjh@openssl.org>
Manish Goregaokar [Sat, 17 Oct 2015 11:10:55 +0000 (16:40 +0530)]
Move contributing info to CONTRIBUTING
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Fri, 16 Oct 2015 15:19:04 +0000 (11:19 -0400)]
Run tests on Travis for mingw builds as well
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Dmitry Belyavsky [Fri, 16 Oct 2015 09:07:57 +0000 (10:07 +0100)]
Fix error message when loading engines from config
When using command line applications errors occur when trying to
load engines specified in a config file. Introduced by commit
a0a82324f96
RT#4093
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Tue, 13 Oct 2015 14:02:47 +0000 (15:02 +0100)]
Remove Obsolete engines
There are a number of engines in the OpenSSL source code which are now
obsolete. The following engines have been removed:
4758cca, aep, atalla,
cswift, nuron, sureware.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Wed, 5 Aug 2015 02:21:40 +0000 (03:21 +0100)]
Fix self signed handling.
Don't mark a certificate as self signed if keyUsage is present and
certificate signing not asserted.
PR#3979
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Sun, 11 Oct 2015 20:13:42 +0000 (21:13 +0100)]
embed CRL serial number and signature fields
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sun, 11 Oct 2015 20:05:49 +0000 (21:05 +0100)]
embed certificate serial number and signature fields
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sun, 11 Oct 2015 19:44:07 +0000 (20:44 +0100)]
embed value field of X509_EXTENSION
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sun, 11 Oct 2015 20:20:19 +0000 (21:20 +0100)]
add CHANGES entry for embed
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sun, 11 Oct 2015 22:25:08 +0000 (23:25 +0100)]
Handle embed flag in ASN1_STRING_copy().
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Thu, 15 Oct 2015 10:53:35 +0000 (12:53 +0200)]
PACKET: fix __owur
Reviewed-by: Matt Caswell <matt@openssl.org>
Emilia Kasper [Thu, 15 Oct 2015 11:27:55 +0000 (13:27 +0200)]
Appease gcc's Wmaybe-uninitialized
False positive: gcc (4.8) can't figure out the SSL_IS_DTLS logic.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Emilia Kasper [Wed, 14 Oct 2015 16:32:38 +0000 (18:32 +0200)]
Remove EVP_CHECK_DES_KEY
Thanks to the OpenBSD community for bringing this to our attention.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Fri, 9 Oct 2015 15:38:47 +0000 (17:38 +0200)]
ct_locl.h: fix some comments
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Fri, 9 Oct 2015 18:00:53 +0000 (20:00 +0200)]
make depend: prefer clang over makedepend
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Mon, 12 Oct 2015 20:14:04 +0000 (21:14 +0100)]
RFC5753 compliance.
RFC5753 requires that we omit parameters for AES key wrap and set them
to NULL for 3DES wrap. OpenSSL decrypt uses the received algorithm
parameters so can transparently handle either form.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Alessandro Ghedini [Tue, 6 Oct 2015 18:27:50 +0000 (20:27 +0200)]
Add Clang 3.6 and additional GCC 5 builds to travis
Follow-up to
f386742.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Alessandro Ghedini [Mon, 12 Oct 2015 20:15:43 +0000 (16:15 -0400)]
GH429: Add clang to travis
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Andy Polyakov <appro@openssl.org>
Andy Polyakov [Mon, 12 Oct 2015 20:31:20 +0000 (22:31 +0200)]
testlib/OpenSSL/Test.pm: remove redundant 'cmd /c', MSWin32 Perl can take care of itself.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 12 Oct 2015 20:26:14 +0000 (22:26 +0200)]
Harmonize do_rehash_rule with updated test/recipies/25-test_verify.t.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 12 Oct 2015 20:24:27 +0000 (22:24 +0200)]
Test suite: chomp->s/\R// to harmonize with mingw 'make test'.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Mon, 12 Oct 2015 20:16:07 +0000 (22:16 +0200)]
Test suite: minimal required to get mingw 'make test' work under Linux.
(part by Alessandro Ghedini)
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Mon, 12 Oct 2015 12:03:50 +0000 (13:03 +0100)]
Rename -set-serial command to req
Previous OpenSSL versions used -set_serial, but master was using
-set-serial - so rename it back to the old version.
RT#4059
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Mon, 12 Oct 2015 11:40:15 +0000 (12:40 +0100)]
Centralise loading default apps config file
Loading the config file after processing command line options can
cause problems, e.g. where an engine provides new ciphers/digests
these are not then recoginised on the command line. Move the
default config file loading to before the command line option
processing. Whilst we're doing this we might as well centralise
this instead of doing it individually for each application. Finally
if we do it before the OpenSSL_add_ssl_algorithms() call then
ciphersuites provided by an engine (e.g. GOST) can be available to
the apps.
RT#4085
RT#4086
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Mon, 12 Oct 2015 08:44:15 +0000 (09:44 +0100)]
Fix option name discrepancy
There used to be options -macopt and -sigopt in <=1.0.2 for the dgst
command line app. These were incorrectly spelled as -macop and -sigop in
master.
RT#4072
Reviewed-by: Andy Polyakov <appro@openssl.org>
Andy Polyakov [Wed, 7 Oct 2015 07:35:12 +0000 (09:35 +0200)]
Configurations: move -Wno-pedantic-ms-format to .travis.yml.
The option is not available in older toolchains and would cause breakage.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Dr. Stephen Henson [Wed, 7 Oct 2015 13:42:34 +0000 (14:42 +0100)]
embed OCSP_CERTID
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Wed, 7 Oct 2015 12:28:46 +0000 (13:28 +0100)]
embed support for ASN1_STRING
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Tue, 6 Oct 2015 22:04:08 +0000 (23:04 +0100)]
Embed various OCSP fields.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Tue, 6 Oct 2015 21:53:48 +0000 (22:53 +0100)]
embed support for CHOICE type
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Sat, 12 Sep 2015 02:53:40 +0000 (03:53 +0100)]
Skip PSK tests for no-psk
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Fri, 11 Sep 2015 16:08:11 +0000 (17:08 +0100)]
Make no-psk compile without warnings.
PR#4035
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Sat, 10 Oct 2015 23:06:56 +0000 (00:06 +0100)]
Typo.
PR#4079
Reviewed-by: Tim Hudson <tjh@openssl.org>
Emilia Kasper [Tue, 6 Oct 2015 15:20:32 +0000 (17:20 +0200)]
DTLS: remove unused cookie field
Note that this commit constifies a user callback parameter and therefore
will break compilation for applications using this callback. But unless
they are abusing write access to the buffer, the fix is trivial.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Matt Caswell [Fri, 9 Oct 2015 11:10:16 +0000 (12:10 +0100)]
Fix Windows build
Add the new ct directory to mkfiles.pl and fix the ct Makefile
Reviewed-by: Andy Polyakov <appro@openssl.org>
Adam Eijdenberg [Tue, 15 Sep 2015 16:13:48 +0000 (09:13 -0700)]
Initial commit for Certificate Transparency support
Original authors:
Rob Stradling <rob@comodo.com>
Dr. Stephen Henson <steve@openssl.org>
Reviewed-by: Emilia Kasper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Fri, 2 Oct 2015 12:40:30 +0000 (14:40 +0200)]
PACKET: simplify ServerKeyExchange parsing
Reviewed-by: Matt Caswell <matt@openssl.org>
Matt Caswell [Thu, 8 Oct 2015 14:29:15 +0000 (15:29 +0100)]
Fix no-ripemd on Windows
mkdef.pl was getting confused by:
# ifdef OPENSSL_NO_RMD160
# error RIPEMD is disabled.
# endif
Changing RIPEMD to RMD160 solves it. Fix suggested by Steve Henson.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Thu, 8 Oct 2015 12:36:10 +0000 (13:36 +0100)]
Don't treat a bare OCTETSTRING as DigestInfo in int_rsa_verify
The function int_rsa_verify is an internal function used for verifying an
RSA signature. It takes an argument |dtype| which indicates the digest type
that was used. Dependant on that digest type the processing of the
signature data will vary. In particular if |dtype == NID_mdc2| and the
signature data is a bare OCTETSTRING then it is treated differently to the
default case where the signature data is treated as a DigestInfo (X509_SIG).
Due to a missing "else" keyword the logic actually correctly processes the
OCTETSTRING format signature first, and then attempts to continue and
process it as DigestInfo. This will invariably fail because we already know
that it is a bare OCTETSTRING.
This failure doesn't actualy make a real difference because it ends up at
the |err| label regardless and still returns a "success" result. This patch
just cleans things up to make it look a bit more sane.
RT#4076
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Thu, 8 Oct 2015 09:53:07 +0000 (11:53 +0200)]
When ENGINE_add finds that id or name is missing, actually return
Reviewed-by: Matt Caswell <matt@openssl.org>
Pascal Cuoq [Wed, 6 May 2015 08:15:28 +0000 (10:15 +0200)]
Don't check pointer we just freed, always set it to NULL.
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
Pascal Cuoq [Tue, 5 May 2015 09:20:39 +0000 (11:20 +0200)]
Move BN_CTX_start() call so the error case can always call BN_CTX_end().
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
Pascal Cuoq [Tue, 5 May 2015 09:20:39 +0000 (11:20 +0200)]
Move BN_CTX_start() call so the error case can always call BN_CTX_end().
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
Pascal Cuoq [Wed, 6 May 2015 07:55:28 +0000 (09:55 +0200)]
Properly check return type of DH_compute_key()
It returns -1 on error, not 0.
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
Pascal Cuoq [Wed, 6 May 2015 09:31:27 +0000 (11:31 +0200)]
Set flags to 0 before calling BN_with_flags()
BN_with_flags() will read the dest->flags to keep the BN_FLG_MALLOCED but
overwrites everything else.
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR #1231
Matt Caswell [Wed, 7 Oct 2015 14:20:47 +0000 (15:20 +0100)]
Don't advance PACKET in ssl_check_for_safari
The function ssl_check_for_safari fingerprints the incoming extensions
to see whether it is one of the broken versions of safari. However it was
failing to reset the PACKET back to the same position it started in, hence
causing some extensions to be skipped incorrectly.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Alessandro Ghedini [Tue, 6 Oct 2015 16:23:42 +0000 (12:23 -0400)]
Fix travis builds on master
-Allow mingw debug builds to fail on Travis CI
-Fix Travis email notifications config
-Rename a variable to avoid a bogus warning with old GCC
error: declaration of ``dup'' shadows a global declaration [-Werror=shadow]
-Disable pedantic ms-format warnings with mingw
-Properly define const DH parameters
-Restore --debug flag in Travis CI builds; -d would get incorrectly passed
to ./Configure in mingw debug builds.
Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Emilia Kasper [Tue, 6 Oct 2015 15:27:35 +0000 (17:27 +0200)]
SSLv2 compat ciphers: clarify comment
Reviewed-by: Matt Caswell <matt@openssl.org>
Dr. Stephen Henson [Tue, 6 Oct 2015 13:15:14 +0000 (14:15 +0100)]
Don't try and parse boolean type.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Mon, 5 Oct 2015 13:23:37 +0000 (15:23 +0200)]
Address more Windows warnings illuminated by mingw.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dmitry Belyavskiy [Sun, 4 Oct 2015 09:11:26 +0000 (12:11 +0300)]
New cipher and cipher modes standardized in Russia
This change introduces short names and NIDs for Russian GOST ciphers
according to GOST R 34.13-2015
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Alessandro Ghedini [Fri, 2 Oct 2015 11:43:29 +0000 (13:43 +0200)]
Validate ClientHello extension field length
RT#4069
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Emilia Kasper [Thu, 1 Oct 2015 11:54:11 +0000 (13:54 +0200)]
Add PACKET_copy_all
Reviewed-by: Matt Caswell <matt@openssl.org>
Emilia Kasper [Thu, 1 Oct 2015 11:00:39 +0000 (13:00 +0200)]
ssl_sess.c: grab a copy of the session ID
The user callback takes a non-const pointer, so don't pass PACKET data
to it directly; rather, grab a local copy.
Reviewed-by: Matt Caswell <matt@openssl.org>
Emilia Kasper [Thu, 1 Oct 2015 10:53:08 +0000 (12:53 +0200)]
PACKETize and clean up ssl_bytes_to_cipher_list.
Fix alerts.
Reviewed-by: Matt Caswell <matt@openssl.org>
Emilia Kasper [Wed, 30 Sep 2015 13:33:12 +0000 (15:33 +0200)]
ssl3_get_client_hello: rearrange logic
Move all packet parsing to the beginning of the method. This limits the
SSLv2 compatibility soup to the parsing, and makes the rest of the
processing uniform.
This is also needed for simpler EMS support: EMS servers need to do an
early scan for EMS to make resumption decisions. This'll be easier when
the entire ClientHello is parsed in the beginning.
As a side effect,
1) PACKETize ssl_get_prev_session and tls1_process_ticket; and
2) Delete dead code for SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG.
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Sun, 4 Oct 2015 19:16:28 +0000 (21:16 +0200)]
make depend
Reviewed-by: Ben Laurie <ben@openssl.org>
Richard Levitte [Sun, 4 Oct 2015 19:12:03 +0000 (21:12 +0200)]
Fix make depend for things being built in subdirectories
Some makedepend mechanisms remove all directory information in the
target, so a dependency can looks like this:
ssl3_record.o: record/ssl3_record.c
However, that doesn't quite suit us, our Makefile has us build
record/ssl3_record.o rather than ssl3_record.o.
To clear this up, a change to util/clean-depend.pl takes care of this
case by looking up the original file in the dependencies and restoring
the directory information from it.
Reviewed-by: Ben Laurie <ben@openssl.org>
Andy Polyakov [Wed, 30 Sep 2015 08:36:21 +0000 (10:36 +0200)]
Harmonize pointer printing and size_t-fy casts.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 30 Sep 2015 08:28:14 +0000 (10:28 +0200)]
bio/bss_log.c: harmonize format string to silence -Wformat.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 30 Sep 2015 08:27:19 +0000 (10:27 +0200)]
Address Windows warnings in apps/.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Wed, 30 Sep 2015 08:15:03 +0000 (10:15 +0200)]
Explicitly cast INVALID_SOCKET to (int) to address warnings on Windows.
Even though SOCKET is effectively declared as (void *) on Windows, it's
not actually a pointer, but an index within per-process table of
kernel objects. The table size is actually limited and its upper limit
is far below upper limit for signed 32-bit integer. This is what makes
cast in question possible.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Dr. Stephen Henson [Sat, 3 Oct 2015 16:15:15 +0000 (17:15 +0100)]
Free up ASN.1 structures at top level only.
When a decoding error in ASN.1 occurs only free up the partial structure
at the top level. This simplifies embedded handling and fixes freeing
up of structures when presented with malformed input.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Kurt Roeckx [Tue, 29 Sep 2015 17:59:48 +0000 (19:59 +0200)]
Fix more d2i cases to properly update the input pointer
Thanks to David Benjamin <davidben@google.com> for pointing them out.
Reviewed-by: Steve Henson <steve@openssl.org>
MR #1198
Rich Salz [Wed, 30 Sep 2015 18:32:49 +0000 (14:32 -0400)]
Remove BIO_s_file_internal macro.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Thu, 1 Oct 2015 12:51:31 +0000 (13:51 +0100)]
Revert "Custom cipher constants"
This reverts commit
3aabc1dd1c969e60bdea8f827d6645ff04c56b67.
Reviewed-by: Stephen Henson <steve@openssl.org>
Dmitry Belyavskiy [Wed, 30 Sep 2015 19:42:57 +0000 (22:42 +0300)]
Custom cipher constants
Add some custom ctrls for Engine specific use.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Wed, 30 Sep 2015 13:44:53 +0000 (15:44 +0200)]
Remove the hard coded -DOPENSSL_NO_DEPRECATED from DEPFLAG
Any time you configure with enable-deprecated, make depend would
scream bloody murder. This change has it quiet down a bit.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Tue, 29 Sep 2015 10:14:35 +0000 (11:14 +0100)]
Change the DEFAULT ciphersuites to exclude DES, RC4 and RC2
This patch updates the "DEFAULT" cipherstring to be
"ALL:!COMPLEMENTOFDEFAULT:!eNULL". COMPLEMENTOFDEFAULT is now defined
internally by a flag on each ciphersuite indicating whether it should be
excluded from DEFAULT or not. This gives us control at an individual
ciphersuite level as to exactly what is in DEFAULT and what is not.
Finally all DES, RC4 and RC2 ciphersuites are added to COMPLEMENTOFDEFAULT
and hence removed from DEFAULT.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Andy Polyakov [Fri, 25 Sep 2015 11:43:00 +0000 (13:43 +0200)]
bn/asm/armv4-mont.pl: boost NEON performance.
Close difference gap on Cortex-A9, which resulted in further improvement
even on other processors.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Mon, 28 Sep 2015 21:00:00 +0000 (17:00 -0400)]
Make update / libeay.num fix
Looks like someone forgot to do a "make update" since crypto/ts/Makefile
keeps changing. So include that.
Second is that the declare_dh_bn macro fools the libeay.num script.
The declarations are only needed in one file (dh_rfc5114) so remove
them from the header and put the "raw" declarations directly into that
file.
Reviewed-by: Richard Levitte <levitte@openssl.org>