oweals/openssl.git
11 years agoghash-x86[_64].pl: code refresh.
Andy Polyakov [Thu, 14 Feb 2013 15:28:09 +0000 (16:28 +0100)]
ghash-x86[_64].pl: code refresh.

11 years ago[aesni-]sha1-x86_64.pl: code refresh.
Andy Polyakov [Thu, 14 Feb 2013 15:14:02 +0000 (16:14 +0100)]
[aesni-]sha1-x86_64.pl: code refresh.

11 years agosha512-x86_64.pl: add AVX2 code path.
Andy Polyakov [Thu, 14 Feb 2013 14:39:42 +0000 (15:39 +0100)]
sha512-x86_64.pl: add AVX2 code path.

11 years agobn_nist.c: work around clang 3.0 bug.
Andy Polyakov [Thu, 14 Feb 2013 08:51:41 +0000 (09:51 +0100)]
bn_nist.c: work around clang 3.0 bug.

11 years agoUpate FAQ.
Dr. Stephen Henson [Tue, 12 Feb 2013 16:02:45 +0000 (16:02 +0000)]
Upate FAQ.

Add description of "allocate and encode" operation for ASN1 routines.

Document how versioning will for after the letter release reaches
y.

11 years agoCheck DTLS_BAD_VER for version number.
David Woodhouse [Tue, 12 Feb 2013 14:55:32 +0000 (14:55 +0000)]
Check DTLS_BAD_VER for version number.

The version check for DTLS1_VERSION was redundant as
DTLS1_VERSION > TLS1_1_VERSION, however we do need to
check for DTLS1_BAD_VER for compatibility.

PR:2984

11 years agoFix in ssltest is no-ssl2 configured
Dr. Stephen Henson [Mon, 11 Feb 2013 18:17:50 +0000 (18:17 +0000)]
Fix in ssltest is no-ssl2 configured
(cherry picked from commit cbf9b4aed3e209fe8a39e1d6f55aaf46d1369dc4)

11 years agoupdate FAQ
Dr. Stephen Henson [Mon, 11 Feb 2013 16:20:03 +0000 (16:20 +0000)]
update FAQ

11 years agoFAQ/README: we are now using Git instead of CVS
Lutz Jaenicke [Mon, 11 Feb 2013 10:29:05 +0000 (11:29 +0100)]
FAQ/README: we are now using Git instead of CVS
(cherry picked from commit f88dbb8385c199a2a28e9525c6bba3a64bda96af)

11 years agosparccpuid.S: work around emulator bug on T1.
Andy Polyakov [Mon, 11 Feb 2013 09:39:50 +0000 (10:39 +0100)]
sparccpuid.S: work around emulator bug on T1.

11 years agos3_cbc.c: make CBC_MAC_ROTATE_IN_PLACE universal.
Andy Polyakov [Fri, 8 Feb 2013 20:30:52 +0000 (21:30 +0100)]
s3_cbc.c: make CBC_MAC_ROTATE_IN_PLACE universal.

11 years agos3_cbc.c: get rid of expensive divisions.
Andy Polyakov [Fri, 8 Feb 2013 15:36:09 +0000 (16:36 +0100)]
s3_cbc.c: get rid of expensive divisions.

11 years agos3_cbc.c: fix warning [in Windows build].
Andy Polyakov [Fri, 8 Feb 2013 13:22:22 +0000 (14:22 +0100)]
s3_cbc.c: fix warning [in Windows build].

11 years agoe_aes_cbc_hmac_sha1.c: align calculated MAC at cache line.
Andy Polyakov [Fri, 8 Feb 2013 09:31:13 +0000 (10:31 +0100)]
e_aes_cbc_hmac_sha1.c: align calculated MAC at cache line.

It also ensures that valgring is happy.

11 years agossl/*: revert "remove SSL_RECORD->orig_len" and merge "fix IV".
Andy Polyakov [Fri, 8 Feb 2013 09:20:48 +0000 (10:20 +0100)]
ssl/*: revert "remove SSL_RECORD->orig_len" and merge "fix IV".

Revert is appropriate because binary compatibility is not an issue
in 1.1.

11 years agoFix for EXP-RC2-CBC-MD5
Adam Langley [Wed, 6 Feb 2013 16:05:40 +0000 (16:05 +0000)]
Fix for EXP-RC2-CBC-MD5

MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.
(cherry picked from commit f306b87d766e6ecf30824635c7c395b67cff9dbc)

11 years agoe_aes_cbc_hmac_sha1.c: cleanse temporary copy of HMAC secret.
Andy Polyakov [Sun, 3 Feb 2013 19:04:39 +0000 (20:04 +0100)]
e_aes_cbc_hmac_sha1.c: cleanse temporary copy of HMAC secret.
(cherry picked from commit 529d27ea472fc2c7ba9190a15a58cb84012d4ec6)

11 years agoe_aes_cbc_hmac_sha1.c: address the CBC decrypt timing issues.
Andy Polyakov [Sat, 2 Feb 2013 18:29:59 +0000 (19:29 +0100)]
e_aes_cbc_hmac_sha1.c: address the CBC decrypt timing issues.

Address CBC decrypt timing issues and reenable the AESNI+SHA1 stitch.
(cherry picked from commit 125093b59f3c2a2d33785b5563d929d0472f1721)

11 years agossl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.
Andy Polyakov [Fri, 1 Feb 2013 14:31:50 +0000 (15:31 +0100)]
ssl/*: remove SSL3_RECORD->orig_len to restore binary compatibility.

Kludge alert. This is arranged by passing padding length in unused
bits of SSL3_RECORD->type, so that orig_len can be reconstructed.
(cherry picked from commit 8bfd4c659f180a6ce34f21c0e62956b362067fba)

11 years agoDon't access EVP_MD_CTX internals directly.
Dr. Stephen Henson [Fri, 1 Feb 2013 13:53:43 +0000 (13:53 +0000)]
Don't access EVP_MD_CTX internals directly.
(cherry picked from commit 04e45b52ee3be81121359cc1198fd01e38096e9f)

11 years agos3/s3_cbc.c: allow for compilations with NO_SHA256|512.
Andy Polyakov [Fri, 1 Feb 2013 09:10:32 +0000 (10:10 +0100)]
s3/s3_cbc.c: allow for compilations with NO_SHA256|512.
(cherry picked from commit d5371324d978e4096bf99b9d0fe71b2cb65d9dc8)

11 years agossl/s3_cbc.c: md_state alignment portability fix.
Andy Polyakov [Fri, 1 Feb 2013 08:59:56 +0000 (09:59 +0100)]
ssl/s3_cbc.c: md_state alignment portability fix.

RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.
(cherry picked from commit 36260233e7e3396feed884d3f501283e0453c04f)

11 years agossl/s3_cbc.c: uint64_t portability fix.
Andy Polyakov [Fri, 1 Feb 2013 08:55:43 +0000 (09:55 +0100)]
ssl/s3_cbc.c: uint64_t portability fix.

Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.
(cherry picked from commit cab13fc8473856a43556d41d8dac5605f4ba1f91)

11 years agotypo.
Dr. Stephen Henson [Thu, 31 Jan 2013 23:04:39 +0000 (23:04 +0000)]
typo.
(cherry picked from commit 34ab3c8c711ff79c2b768f0b17e4b2a78fd1df5d)

11 years agoAdd ordinal for CRYPTO_memcmp: since this will affect multiple
Dr. Stephen Henson [Thu, 31 Jan 2013 15:19:00 +0000 (15:19 +0000)]
Add ordinal for CRYPTO_memcmp: since this will affect multiple
branches it needs to be in a "gap".
(cherry picked from commit 81ce0e14e72e8e255ad1bd9c7cfaa47a6291919c)

11 years agoTiming fix mitigation for FIPS mode.
Dr. Stephen Henson [Tue, 29 Jan 2013 14:44:36 +0000 (14:44 +0000)]
Timing fix mitigation for FIPS mode.
We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
to cover any timing differences caused by removal of padding.
(cherry picked from commit b908e88ec15aa0a74805e3f2236fc4f83f2789c2)

11 years agoOops. Add missing file.
Ben Laurie [Mon, 28 Jan 2013 18:24:55 +0000 (18:24 +0000)]
Oops. Add missing file.
(cherry picked from commit 014265eb02e26f35c8db58e2ccbf100b0b2f0072)

11 years agoUpdate DTLS code to match CBC decoding in TLS.
Ben Laurie [Mon, 28 Jan 2013 17:34:33 +0000 (17:34 +0000)]
Update DTLS code to match CBC decoding in TLS.

This change updates the DTLS code to match the constant-time CBC
behaviour in the TLS.
(cherry picked from commit 9f27de170d1b7bef3d46d41382dc4dafde8b3900)

11 years agoDon't crash when processing a zero-length, TLS >= 1.1 record.
Ben Laurie [Mon, 28 Jan 2013 17:33:18 +0000 (17:33 +0000)]
Don't crash when processing a zero-length, TLS >= 1.1 record.

The previous CBC patch was bugged in that there was a path through enc()
in s3_pkt.c/d1_pkt.c which didn't set orig_len. orig_len would be left
at the previous value which could suggest that the packet was a
sufficient length when it wasn't.
(cherry picked from commit 6cb19b7681f600b2f165e4adc57547b097b475fd)

11 years agoMake CBC decoding constant time.
Ben Laurie [Mon, 28 Jan 2013 17:31:49 +0000 (17:31 +0000)]
Make CBC decoding constant time.

This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.

This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.

In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
(cherry picked from commit e130841bccfc0bb9da254dc84e23bc6a1c78a64e)

11 years agoAdd and use a constant-time memcmp.
Ben Laurie [Mon, 28 Jan 2013 17:30:38 +0000 (17:30 +0000)]
Add and use a constant-time memcmp.

This change adds CRYPTO_memcmp, which compares two vectors of bytes in
an amount of time that's independent of their contents. It also changes
several MAC compares in the code to use this over the standard memcmp,
which may leak information about the size of a matching prefix.
(cherry picked from commit 2ee798880a246d648ecddadc5b91367bee4a5d98)

11 years agoFix for trace code: SSL3 doesn't include a length value for
Dr. Stephen Henson [Mon, 4 Feb 2013 14:53:47 +0000 (14:53 +0000)]
Fix for trace code: SSL3 doesn't include a length value for
encrypted premaster secret value.

11 years agox86_64 assembly pack: keep making Windows build more robust.
Andy Polyakov [Sat, 2 Feb 2013 18:52:43 +0000 (19:52 +0100)]
x86_64 assembly pack: keep making Windows build more robust.

PR: 2963 and a number of others

11 years agoDon't use C++ style comments.
Dr. Stephen Henson [Thu, 24 Jan 2013 23:22:33 +0000 (23:22 +0000)]
Don't use C++ style comments.

11 years agoFix warning: lenmax isn't used any more.
Dr. Stephen Henson [Thu, 24 Jan 2013 14:06:54 +0000 (14:06 +0000)]
Fix warning: lenmax isn't used any more.

11 years agoDon't include comp.h in cmd_cd.c if OPENSSL_NO_COMP set
Dr. Stephen Henson [Wed, 23 Jan 2013 01:04:36 +0000 (01:04 +0000)]
Don't include comp.h in cmd_cd.c if OPENSSL_NO_COMP set

11 years agofix domd
Dr. Stephen Henson [Wed, 23 Jan 2013 00:43:09 +0000 (00:43 +0000)]
fix domd

11 years agox86_64 assembly pack: make Windows build more robust.
Andy Polyakov [Tue, 22 Jan 2013 21:11:31 +0000 (22:11 +0100)]
x86_64 assembly pack: make Windows build more robust.

PR: 2963 and a number of others

11 years agoTABLE update.
Andy Polyakov [Tue, 22 Jan 2013 20:21:03 +0000 (21:21 +0100)]
TABLE update.

11 years agoConfigure: update linux-mips* lines.
Andy Polyakov [Tue, 22 Jan 2013 20:20:34 +0000 (21:20 +0100)]
Configure: update linux-mips* lines.

11 years agobn/asm/mips.pl: hardwire local call to bn_div_words.
Andy Polyakov [Tue, 22 Jan 2013 20:13:37 +0000 (21:13 +0100)]
bn/asm/mips.pl: hardwire local call to bn_div_words.

11 years agosha512-ppc.pl: minimize stack frame.
Andy Polyakov [Tue, 22 Jan 2013 20:09:14 +0000 (21:09 +0100)]
sha512-ppc.pl: minimize stack frame.

11 years agogost2814789t.c: portability fixes.
Andy Polyakov [Tue, 22 Jan 2013 13:37:03 +0000 (14:37 +0100)]
gost2814789t.c: portability fixes.

11 years agoFix warnings.
Ben Laurie [Mon, 21 Jan 2013 23:02:17 +0000 (23:02 +0000)]
Fix warnings.

11 years agoDon't include comp.h if no-comp set.
Dr. Stephen Henson [Sun, 20 Jan 2013 02:34:25 +0000 (02:34 +0000)]
Don't include comp.h if no-comp set.

11 years agoImprove WINCE support.
Andy Polyakov [Sat, 19 Jan 2013 20:23:13 +0000 (21:23 +0100)]
Improve WINCE support.

Submitted by: Pierre Delaage

11 years agoMerge branch 'master' of openssl.net:openssl
Ben Laurie [Sat, 19 Jan 2013 18:30:10 +0000 (18:30 +0000)]
Merge branch 'master' of openssl.net:openssl

11 years agoMore .gitignore adjustments.
Andy Polyakov [Sat, 19 Jan 2013 17:41:44 +0000 (18:41 +0100)]
More .gitignore adjustments.

11 years agoMerge branch 'master' of openssl.net:openssl
Ben Laurie [Sat, 19 Jan 2013 17:35:41 +0000 (17:35 +0000)]
Merge branch 'master' of openssl.net:openssl

11 years agoRemove kludge to use RC4 asm.
Ben Laurie [Sat, 19 Jan 2013 17:31:46 +0000 (17:31 +0000)]
Remove kludge to use RC4 asm.

11 years agoBuild/test cleanly on MacOS.
Ben Laurie [Sat, 19 Jan 2013 17:24:40 +0000 (17:24 +0000)]
Build/test cleanly on MacOS.

11 years agogost_crypt.c: add assertions.
Andy Polyakov [Sat, 19 Jan 2013 17:10:05 +0000 (18:10 +0100)]
gost_crypt.c: add assertions.

Submitted by: Seguei Leontiev
PR: 2821

11 years agoengines/ccgost: add test case.
Andy Polyakov [Sat, 19 Jan 2013 16:56:56 +0000 (17:56 +0100)]
engines/ccgost: add test case.

Submitted by: Serguei Leontiev
PR: 2821

11 years agosha512-ppc.pl: add PPC32 code, >2x improvement on in-order cores.
Andy Polyakov [Sat, 19 Jan 2013 16:22:05 +0000 (17:22 +0100)]
sha512-ppc.pl: add PPC32 code, >2x improvement on in-order cores.

11 years agoRemove extraneous brackets (clang doesn't like them).
Ben Laurie [Sat, 19 Jan 2013 15:12:08 +0000 (15:12 +0000)]
Remove extraneous brackets (clang doesn't like them).

11 years agoCan't check a size_t for < 0.
Ben Laurie [Sat, 19 Jan 2013 15:00:27 +0000 (15:00 +0000)]
Can't check a size_t for < 0.

11 years agoMake "make depend" work on MacOS out of the box.
Ben Laurie [Sat, 19 Jan 2013 14:14:30 +0000 (14:14 +0000)]
Make "make depend" work on MacOS out of the box.

11 years ago.gitignore adjustments
Andy Polyakov [Sat, 19 Jan 2013 12:20:21 +0000 (13:20 +0100)]
.gitignore adjustments

11 years agoTypo (PR2959).
Dr. Stephen Henson [Thu, 17 Jan 2013 18:20:18 +0000 (18:20 +0000)]
Typo (PR2959).

11 years agoFix some clang warnings.
Ben Laurie [Sun, 13 Jan 2013 21:04:39 +0000 (21:04 +0000)]
Fix some clang warnings.

11 years agoCorrect EVP_PKEY_verifyrecover to EVP_PKEY_verify_recover (RT 2955).
Ben Laurie [Sat, 12 Jan 2013 12:25:30 +0000 (12:25 +0000)]
Correct EVP_PKEY_verifyrecover to EVP_PKEY_verify_recover (RT 2955).

11 years agoChange default bits to 1024
Dr. Stephen Henson [Mon, 7 Jan 2013 16:13:48 +0000 (16:13 +0000)]
Change default bits to 1024

11 years agoAdd some missing files, make paths absolute.
Ben Laurie [Sun, 6 Jan 2013 19:06:40 +0000 (19:06 +0000)]
Add some missing files, make paths absolute.

11 years agoFix warning.
Ben Laurie [Sun, 6 Jan 2013 19:03:48 +0000 (19:03 +0000)]
Fix warning.

11 years agoInitial .gitignore
Dr. Stephen Henson [Sun, 6 Jan 2013 16:47:36 +0000 (16:47 +0000)]
Initial .gitignore

11 years agomake no-comp compile
Dr. Stephen Henson [Sun, 30 Dec 2012 16:04:51 +0000 (16:04 +0000)]
make no-comp compile

11 years agomake JPAKE work again, fix memory leaks
Dr. Stephen Henson [Sat, 29 Dec 2012 23:38:20 +0000 (23:38 +0000)]
make JPAKE work again, fix memory leaks

11 years agostop warning when compiling with no-comp
Dr. Stephen Henson [Sat, 29 Dec 2012 23:37:56 +0000 (23:37 +0000)]
stop warning when compiling with no-comp

11 years agoPortability fix: use BIO_snprintf and pick up strcasecmp alternative
Dr. Stephen Henson [Wed, 26 Dec 2012 23:51:56 +0000 (23:51 +0000)]
Portability fix: use BIO_snprintf and pick up strcasecmp alternative
definitions from e_os.h

11 years agomissing tab
Dr. Stephen Henson [Wed, 26 Dec 2012 19:12:57 +0000 (19:12 +0000)]
missing tab

11 years agotypo
Dr. Stephen Henson [Wed, 26 Dec 2012 15:23:42 +0000 (15:23 +0000)]
typo

11 years agoFix tocsp: we don't need -trust_other any more.
Dr. Stephen Henson [Fri, 21 Dec 2012 18:32:33 +0000 (18:32 +0000)]
Fix tocsp: we don't need -trust_other any more.

Fix typo.

11 years agoMake partial chain checking work if we only have the EE certificate in
Dr. Stephen Henson [Fri, 21 Dec 2012 18:31:32 +0000 (18:31 +0000)]
Make partial chain checking work if we only have the EE certificate in
the trust store.

11 years agoadd missing newline
Dr. Stephen Henson [Fri, 21 Dec 2012 16:24:48 +0000 (16:24 +0000)]
add missing newline

11 years agorevert OCSP_basic_verify changes: they aren't needed now we support partial chain...
Dr. Stephen Henson [Thu, 20 Dec 2012 18:51:00 +0000 (18:51 +0000)]
revert OCSP_basic_verify changes: they aren't needed now we support partial chain verification and can pass verify options to ocsp utility

11 years agoUpdate test OCSP script "tocsp" to use shell functions and to use
Dr. Stephen Henson [Thu, 20 Dec 2012 18:48:11 +0000 (18:48 +0000)]
Update test OCSP script "tocsp" to use shell functions and to use
December 17th as check date to avoid certificate expiry errors.

11 years agogost_crypt.c: more intuitive ceiling.
Andy Polyakov [Wed, 19 Dec 2012 17:24:46 +0000 (17:24 +0000)]
gost_crypt.c: more intuitive ceiling.

11 years agocorrect CHANGES
Dr. Stephen Henson [Wed, 19 Dec 2012 14:34:39 +0000 (14:34 +0000)]
correct CHANGES

11 years agoengines/cchost/gost_crypt.c: fix typo.
Andy Polyakov [Wed, 19 Dec 2012 11:06:00 +0000 (11:06 +0000)]
engines/cchost/gost_crypt.c: fix typo.

11 years agoengines/e_capi.c: fix typo.
Andy Polyakov [Wed, 19 Dec 2012 10:54:47 +0000 (10:54 +0000)]
engines/e_capi.c: fix typo.

Submitted by: Pierre Delaage

11 years agoengine/cchost: fix bugs.
Andy Polyakov [Wed, 19 Dec 2012 10:45:13 +0000 (10:45 +0000)]
engine/cchost: fix bugs.

PR: 2821
Submitted by: Dmitry Belyavsky, Serguei Leontiev

11 years agodso/dso_win32.c: fix compiler warning.
Andy Polyakov [Tue, 18 Dec 2012 18:19:54 +0000 (18:19 +0000)]
dso/dso_win32.c: fix compiler warning.

11 years agoutil/pl/VC-32.pl fix typo.
Andy Polyakov [Tue, 18 Dec 2012 18:07:20 +0000 (18:07 +0000)]
util/pl/VC-32.pl fix typo.

11 years agoUse client version when deciding which cipher suites to disable.
Dr. Stephen Henson [Tue, 18 Dec 2012 13:25:47 +0000 (13:25 +0000)]
Use client version when deciding which cipher suites to disable.

11 years agoutil/pl/VC-32.pl: refresh, switch to ws2, add crypt32, fix typo (based on
Andy Polyakov [Tue, 18 Dec 2012 09:42:31 +0000 (09:42 +0000)]
util/pl/VC-32.pl: refresh, switch to ws2, add crypt32, fix typo (based on
suggestions from Pierre Delaage).

11 years agoVC-32.pl: fix typo.
Andy Polyakov [Sun, 16 Dec 2012 19:39:24 +0000 (19:39 +0000)]
VC-32.pl: fix typo.

Submitted by: Pierre Delaage

11 years agod1_lib.c,bss_dgram.c: eliminate dependency on _ftime.
Andy Polyakov [Sun, 16 Dec 2012 19:02:59 +0000 (19:02 +0000)]
d1_lib.c,bss_dgram.c: eliminate dependency on _ftime.

11 years agoadd -rmd option to set OCSP response signing digest
Dr. Stephen Henson [Sun, 16 Dec 2012 00:10:03 +0000 (00:10 +0000)]
add -rmd option to set OCSP response signing digest

11 years agoCheck chain is not NULL before assuming we have a validated chain.
Dr. Stephen Henson [Sat, 15 Dec 2012 02:58:00 +0000 (02:58 +0000)]
Check chain is not NULL before assuming we have a validated chain.

The modification to the OCSP helper purpose breaks normal OCSP verification.
It is no longer needed now we can trust partial chains.

11 years agoReturn success when the responder is active.
Dr. Stephen Henson [Sat, 15 Dec 2012 02:56:02 +0000 (02:56 +0000)]
Return success when the responder is active.

Don't verify our own responses.

11 years agotypo
Dr. Stephen Henson [Sat, 15 Dec 2012 00:29:12 +0000 (00:29 +0000)]
typo

11 years agoAdd support for '-' as input and output filenames in ocsp utility.
Dr. Stephen Henson [Fri, 14 Dec 2012 23:30:56 +0000 (23:30 +0000)]
Add support for '-' as input and output filenames in ocsp utility.

Recognise verification arguments.

11 years agooops, revert, committed in error
Dr. Stephen Henson [Fri, 14 Dec 2012 23:29:58 +0000 (23:29 +0000)]
oops, revert, committed in error

11 years agoapps/ocsp.c
Dr. Stephen Henson [Fri, 14 Dec 2012 23:28:19 +0000 (23:28 +0000)]
apps/ocsp.c

11 years agoDocumentation improvements by Chris Palmer (Google).
Ben Laurie [Fri, 14 Dec 2012 13:28:49 +0000 (13:28 +0000)]
Documentation improvements by Chris Palmer (Google).

11 years agofips/fipsld: improve cross-compile support.
Andy Polyakov [Thu, 13 Dec 2012 22:51:01 +0000 (22:51 +0000)]
fips/fipsld: improve cross-compile support.

11 years agoUse new partial chain flag instead of modifying input parameters.
Dr. Stephen Henson [Thu, 13 Dec 2012 18:20:47 +0000 (18:20 +0000)]
Use new partial chain flag instead of modifying input parameters.

11 years agoNew verify flag to return success if we have any certificate in the
Dr. Stephen Henson [Thu, 13 Dec 2012 18:14:46 +0000 (18:14 +0000)]
New verify flag to return success if we have any certificate in the
trusted store instead of the default which is to return an error if
we can't build the complete chain.

11 years agoDocument -pubkey.
Ben Laurie [Thu, 13 Dec 2012 16:17:55 +0000 (16:17 +0000)]
Document -pubkey.

11 years agoImprove my 64-bit debug target.
Ben Laurie [Wed, 12 Dec 2012 14:14:43 +0000 (14:14 +0000)]
Improve my 64-bit debug target.