Bodo Möller [Thu, 25 Oct 2001 08:44:10 +0000 (08:44 +0000)]
mention des_old.h
Bodo Möller [Thu, 25 Oct 2001 08:25:19 +0000 (08:25 +0000)]
Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of
the e-mail address in the DN (i.e., it will go into a certificate
extension only). The new configuration file option 'email_in_dn = no'
has the same effect.
Submitted by: Massimiliano Pala madwolf@openca.org
Bodo Möller [Thu, 25 Oct 2001 08:23:13 +0000 (08:23 +0000)]
filenames are des_old.[ch], not des.comp*
Bodo Möller [Thu, 25 Oct 2001 08:17:53 +0000 (08:17 +0000)]
Consistency with s2_... and s23_... variants (no real functional
change)
Richard Levitte [Thu, 25 Oct 2001 06:46:22 +0000 (06:46 +0000)]
Remove DES_random_seed() but retain des_random_seed() for now. Change
the docs to reflect this change and correct libeay.num.
Bodo Möller [Thu, 25 Oct 2001 06:09:51 +0000 (06:09 +0000)]
Assume TLS 1.0 when ClientHello fragment is too short.
Richard Levitte [Thu, 25 Oct 2001 05:37:10 +0000 (05:37 +0000)]
Have the removal warnings very high up in the source.
Richard Levitte [Wed, 24 Oct 2001 21:31:14 +0000 (21:31 +0000)]
A C file is a C file is a C file!
Richard Levitte [Wed, 24 Oct 2001 21:21:12 +0000 (21:21 +0000)]
Due to an increasing number of clashes between modern OpenSSL and
libdes (which is still used out there) or other des implementations,
the OpenSSL DES functions are renamed to begin with DES_ instead of
des_. Compatibility routines are provided and declared by including
openssl/des_old.h. Those declarations are the same as were in des.h
when the OpenSSL project started, which is exactly how libdes looked
at that time, and hopefully still looks today.
The compatibility functions will be removed in some future release, at
the latest in version 1.0.
Bodo Möller [Wed, 24 Oct 2001 19:03:22 +0000 (19:03 +0000)]
Fix SSL handshake functions and SSL_clear() such that SSL_clear()
never resets s->method to s->ctx->method when called from within
one of the SSL handshake functions.
Richard Levitte [Wed, 24 Oct 2001 15:32:53 +0000 (15:32 +0000)]
Deprecate the macro MAC_OS_pre_X.
Richard Levitte [Wed, 24 Oct 2001 15:32:14 +0000 (15:32 +0000)]
make update
Richard Levitte [Wed, 24 Oct 2001 08:27:22 +0000 (08:27 +0000)]
make update
Richard Levitte [Tue, 23 Oct 2001 14:30:57 +0000 (14:30 +0000)]
Correction of the id-pda OID's.
Submitted by Frederic.Giudicelli@INTRINsec.com
Dr. Stephen Henson [Tue, 23 Oct 2001 00:54:58 +0000 (00:54 +0000)]
Sanitize CHANGES entry.
Bodo Möller [Mon, 22 Oct 2001 13:59:36 +0000 (13:59 +0000)]
Fix memory leak.
Dr. Stephen Henson [Sun, 21 Oct 2001 02:09:15 +0000 (02:09 +0000)]
Reject certificates with unhandled critical extensions.
Dr. Stephen Henson [Sun, 21 Oct 2001 01:05:53 +0000 (01:05 +0000)]
Stop spurious "unable to load config info" errors in req
Bodo Möller [Sat, 20 Oct 2001 18:56:01 +0000 (18:56 +0000)]
Call msg_callback with correct length parameter if ssl3_write_bytes had to
be called multiple times
Bodo Möller [Sat, 20 Oct 2001 17:56:36 +0000 (17:56 +0000)]
New functions SSL[_CTX]_set_msg_callback().
New macros SSL[_CTX]_set_msg_callback_arg().
Message callback imlementation for SSL 3.0/TLS 1.0 (no SSL 2.0 yet).
New '-msg' option for 'openssl s_client' and 'openssl s_server'
that enable a message callback that displays all protocol messages.
In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert if
client_version is smaller than the protocol version in use.
Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0
if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the
client will at least see that alert.
Fix SSL[_CTX]_ctrl prototype (void * instead of char * for generic
pointer).
Add/update some OpenSSL copyright notices.
Dr. Stephen Henson [Sat, 20 Oct 2001 16:22:28 +0000 (16:22 +0000)]
Typo.
Dr. Stephen Henson [Sat, 20 Oct 2001 16:18:03 +0000 (16:18 +0000)]
Add missing EVP_CIPHER_CTX_{init,cleanup}
Bodo Möller [Wed, 17 Oct 2001 20:44:25 +0000 (20:44 +0000)]
gcc complained about "write" being shadowed even though the "write"
variable name occured just in a function *prototype* -- so rename it
Richard Levitte [Wed, 17 Oct 2001 17:54:17 +0000 (17:54 +0000)]
Wrong place...
Richard Levitte [Wed, 17 Oct 2001 16:03:42 +0000 (16:03 +0000)]
The EVP_*Init_ex() functions take one extra argument. Let's default
it to NULL.
Bodo Möller [Wed, 17 Oct 2001 11:56:26 +0000 (11:56 +0000)]
document SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
Dr. Stephen Henson [Wed, 17 Oct 2001 01:50:32 +0000 (01:50 +0000)]
Update docs.
Dr. Stephen Henson [Wed, 17 Oct 2001 00:37:12 +0000 (00:37 +0000)]
Modify EVP cipher behaviour in a similar way
to digests to retain compatibility.
Lutz Jänicke [Tue, 16 Oct 2001 14:24:46 +0000 (14:24 +0000)]
Flush buffers to prevent mixed output (Adam Back <adam@cypherspace.org>).
Bodo Möller [Tue, 16 Oct 2001 13:09:24 +0000 (13:09 +0000)]
Add per-SSL 'msg_callback' with 'msg_callback_arg'.
Both have per-SSL_CTX defaults.
These new values can be set by calling SSL[_CTX]_[callback_]ctrl
with codes SSL_CTRL_SET_MSG_CALLBACK and SSL_CTRL_SET_MSG_CALLBACK_ARG.
So far, the callback is never actually called.
Also rearrange some SSL_CTX struct members (some exist just in
SSL_CTXs, others are defaults for SSLs and are either copied
during SSL_new, or used if the value in the SSL is not set;
these three classes of members were not in a logical order),
and add some missing assignments to SSL_dup.
Dr. Stephen Henson [Tue, 16 Oct 2001 02:22:59 +0000 (02:22 +0000)]
Update docs.
Dr. Stephen Henson [Tue, 16 Oct 2001 01:24:29 +0000 (01:24 +0000)]
Retain compatibility of EVP_DigestInit() and EVP_DigestFinal()
with existing code.
Modify library to use digest *_ex() functions.
Bodo Möller [Tue, 16 Oct 2001 00:56:04 +0000 (00:56 +0000)]
The message header for fake SSL 3.0/TLS 1.0 client hellos created from
SSL 2.0 client hellos added with the previous commit was totally wrong --
it must start with the message type, not the protocol version.
(Not that this particular header is actually used anywhere ...)
Bodo Möller [Mon, 15 Oct 2001 20:16:36 +0000 (20:16 +0000)]
For consistency, set s->init_num in the 'reuse_message' case
(if s23_srvr.c faked the message, s->init_num is 0).
Bodo Möller [Mon, 15 Oct 2001 19:49:25 +0000 (19:49 +0000)]
Change ssl3_get_message and the functions using it so that complete
'Handshake' protocol structures are kept in memory, including
'msg_type' and 'length'.
(This is in preparation of future support for callbacks that get to
peek at handshake messages and the like.)
Bodo Möller [Mon, 15 Oct 2001 17:58:00 +0000 (17:58 +0000)]
make sure .rnd exists
Bodo Möller [Mon, 15 Oct 2001 17:41:41 +0000 (17:41 +0000)]
Fix ssl3_get_message handle message fragmentation correctly.
Bodo Möller [Mon, 15 Oct 2001 17:40:42 +0000 (17:40 +0000)]
the previous commit accidentily removed 'ret = 1' from the SSL_ST_OK
case of ssl3_accept
Ulf Möller [Sun, 14 Oct 2001 00:57:30 +0000 (00:57 +0000)]
openbsd-x86 macros
Submitted by: Toomas Kiisk <vix@cyber.ee>
Lutz Jänicke [Fri, 12 Oct 2001 12:29:16 +0000 (12:29 +0000)]
Update information as a partial response to the post
From: "Chris D. Peterson" <cpeterson@aventail.com>
Subject: Implementation Issues with OpenSSL
To: openssl-users@openssl.org
Date: Wed, 22 Aug 2001 16:13:17 -0700
The patch included in the original post may improve the internal session
list handling (and is therefore worth a seperate investigation).
No change to the list handling will however solve the problems of incorrect
SSL_SESSION_free() calls. The session list is only one possible point of
failure, dangling pointers would also occur for SSL object currently
using the session. The correct solution is to only use SSL_SESSION_free()
when applicable!
Richard Levitte [Thu, 11 Oct 2001 19:38:40 +0000 (19:38 +0000)]
In certain cases, no encoding has been set up for the b64 filter. In
such cases, a flush should *not* attempt to finalise the encoding, as
the EVP_ENCODE_CTX structure will only be filled with garbage. For
the same reason, do the same check when a wpending is performed.
Richard Levitte [Wed, 10 Oct 2001 21:52:06 +0000 (21:52 +0000)]
'make update'
Richard Levitte [Wed, 10 Oct 2001 21:37:45 +0000 (21:37 +0000)]
Add support for md4WithRSAEncryption.
Richard Levitte [Wed, 10 Oct 2001 14:46:41 +0000 (14:46 +0000)]
For systems where gcc is used and where we don't know if GNU ld is
used or not, let's ask collect2 which ld it uses and choose to use the
target do-gnu_shared if GNU ld is used.
This solves the reported problems on Solaris systems where GNU cc is
used but GNU ld isn't, and probably on other systems with similar
setups.
Richard Levitte [Wed, 10 Oct 2001 08:27:52 +0000 (08:27 +0000)]
'make update'
Richard Levitte [Wed, 10 Oct 2001 08:27:28 +0000 (08:27 +0000)]
It seems like gcc does canonicalisation of file names. More
specifically, a starting './' is removed. makedepend doesn't do this,
resulting in another possible commit war, so let's fix that by doing a
poor mans canonicalisation of file names that gives the same effect as
doing dependencies through gcc.
Richard Levitte [Wed, 10 Oct 2001 07:56:20 +0000 (07:56 +0000)]
'make update'
Richard Levitte [Wed, 10 Oct 2001 07:55:02 +0000 (07:55 +0000)]
To avoid commit wars over dependencies, let's make it so things that
depend on the environment, like the presence of the OpenBSD crypto
device or of Kerberos, do not change the dependencies within OpenSSL.
Richard Levitte [Wed, 10 Oct 2001 07:44:54 +0000 (07:44 +0000)]
makedepend sometimes produces duplicates. Remove them.
Richard Levitte [Tue, 9 Oct 2001 15:32:23 +0000 (15:32 +0000)]
A few more OIDs, contributed by Peter Sylvester <Peter.Sylvester@EdelWeb.fr>
Geoff Thorpe [Tue, 9 Oct 2001 01:38:31 +0000 (01:38 +0000)]
evp_test.c and evptests.txt both need to be linked in the test/ directory
however for different reasons. This separation should prevent the win32
build from interpreting evptests.txt as source code.
Geoff Thorpe [Mon, 8 Oct 2001 17:25:42 +0000 (17:25 +0000)]
Change some EVP prototypes to use "cipher" rather than "type" as a variable
name. The implementations already use this anyway.
Geoff Thorpe [Mon, 8 Oct 2001 17:24:10 +0000 (17:24 +0000)]
EVP_EncryptInit_ex() and EVP_DecryptInit_ex() had been defined in evp.h but
not implemented. (Bug reported by Martin Szotkowski)
This also changes the non-"_ex" versions to defer directly to
EVP_CipherInit_ex() rather than EVP_CipherInit() to avoid an unecessary
level of indirection.
Geoff Thorpe [Mon, 8 Oct 2001 17:08:17 +0000 (17:08 +0000)]
As ENGINE_load_openbsd_dev_crypto() is an API function, it makes sense for
it to be defined on all platforms whether or not it is of any practical
use on them. This also resolves linker problems on "special" platforms,
such as win32.
Geoff Thorpe [Mon, 8 Oct 2001 17:06:52 +0000 (17:06 +0000)]
Make sure the "ENGINE_TABLE" cleanup callbacks have correct prototypes.
Geoff Thorpe [Mon, 8 Oct 2001 14:44:38 +0000 (14:44 +0000)]
Missing pointer in the eng_table_register function. Reported by
Martin Szotkowski.
Lutz Jänicke [Mon, 8 Oct 2001 08:37:24 +0000 (08:37 +0000)]
Small documentation fixes (Howard Lum <howard@pumpkin.canada.sun.com>)
Richard Levitte [Thu, 4 Oct 2001 21:15:03 +0000 (21:15 +0000)]
Copy evptests.txt to the right place.
Richard Levitte [Thu, 4 Oct 2001 19:25:12 +0000 (19:25 +0000)]
Typo...
Richard Levitte [Thu, 4 Oct 2001 12:27:39 +0000 (12:27 +0000)]
SSL_add_dir_cert_subjects_to_stack for Win32 finally implemented.
Submitted by Massimo Santin <msantin@santineassociati.com>.
Richard Levitte [Thu, 4 Oct 2001 07:49:09 +0000 (07:49 +0000)]
'make update'
Richard Levitte [Thu, 4 Oct 2001 07:46:30 +0000 (07:46 +0000)]
Since ossl_typ.h is an exported header, we sure need to export it on
VMS as well :-).
Richard Levitte [Thu, 4 Oct 2001 07:34:45 +0000 (07:34 +0000)]
Because there's chances we clash with the system's types.h, rename our
types.h to ossl_typ.h.
Also, it seems like krb5 was forgotten in some places.
Richard Levitte [Thu, 4 Oct 2001 07:32:46 +0000 (07:32 +0000)]
Because there's chances we clash with the system's types.h, rename our
types.h to ossl_typ.h.
Dr. Stephen Henson [Wed, 3 Oct 2001 12:47:03 +0000 (12:47 +0000)]
Use the maximum block length for the extra size in the encrypt
BIO buffer instead of hard coding it as 8.
Dr. Stephen Henson [Tue, 2 Oct 2001 16:19:49 +0000 (16:19 +0000)]
Make EVP_DecryptUpdate work again.
Richard Levitte [Tue, 2 Oct 2001 11:49:55 +0000 (11:49 +0000)]
sch isn't an array, how did this pass through gcc?
Richard Levitte [Tue, 2 Oct 2001 11:06:42 +0000 (11:06 +0000)]
A lot of things are undeclared unless x509.h is included.
Richard Levitte [Tue, 2 Oct 2001 10:03:15 +0000 (10:03 +0000)]
Hmm, everything "open" isn't necessarely "openssl" :-).
*sigh* habit...
Richard Levitte [Mon, 1 Oct 2001 17:20:28 +0000 (17:20 +0000)]
Woopsie...
Richard Levitte [Mon, 1 Oct 2001 17:16:24 +0000 (17:16 +0000)]
'make update'
Richard Levitte [Mon, 1 Oct 2001 17:15:28 +0000 (17:15 +0000)]
sk_ENGINE_CLEANUP_ITEM_pop_free() is duplicated in ENGINE_cleanup().
Let's use sk_ENGINE_CLEANUP_ITEM_pop_free() instead.
Richard Levitte [Mon, 1 Oct 2001 17:10:10 +0000 (17:10 +0000)]
Addapt seldom compiled code to new semantics of the key schedule (not
a pointer any more).
Richard Levitte [Mon, 1 Oct 2001 17:09:17 +0000 (17:09 +0000)]
Some new symbols have very long names...
Richard Levitte [Mon, 1 Oct 2001 17:08:18 +0000 (17:08 +0000)]
o_time.c contains symbols with dollar signs in them, so we must tell
the compiler not to warn about that.
Geoff Thorpe [Mon, 1 Oct 2001 16:39:58 +0000 (16:39 +0000)]
The cleanup stack in ENGINE changed slightly, so this "make update" is
needed.
Geoff Thorpe [Mon, 1 Oct 2001 16:26:00 +0000 (16:26 +0000)]
The STACK macros take care of casting to and from the designated item type
of the stack, and the (void *) type used in the underlying sk_***
functions. However, declaring a STACK_OF(type) where type is a *function*
type implicitly involves casts between function pointers and data pointers.
That's a no-no. This changes the ENGINE_CLEANUP handling to use a regular
data type in the stack.
Geoff Thorpe [Mon, 1 Oct 2001 15:56:25 +0000 (15:56 +0000)]
Make an (overdue) note about the recent ENGINE restructuring. Apart from
a few items however, most of the details are deferred to the
crypto/engine/README file.
Geoff Thorpe [Mon, 1 Oct 2001 15:41:31 +0000 (15:41 +0000)]
Make "openssl engine -c" list any supported digests as well as supported
ciphers.
Lutz Jänicke [Mon, 1 Oct 2001 14:43:47 +0000 (14:43 +0000)]
Typos (Chris Pepper <pepper@mail.reppep.com>)
Richard Levitte [Fri, 28 Sep 2001 10:34:48 +0000 (10:34 +0000)]
Change HZ in speed to rely on sysconf() if the clock tick is available
that way. Synchronise s_time with these changes.
Geoff Thorpe [Fri, 28 Sep 2001 02:25:14 +0000 (02:25 +0000)]
ENGINE_register_all_complete() will register all implementations of all
algorithms present in all loaded ENGINEs. The result is that if any of
those ENGINEs successfully initialises, and the ENGINE_TABLE_FLAG_NOINIT
flag isn't set, then they will always be used (and cached as defaults) in
preference to software implementations. Ie. accidental auto-detection of
acceleration hardware :-)
This change stops all implementations being automatically registered in
"openssl" sub-commands, so that the "setup_engine()" handler in apps.c
controls which ENGINEs are registered for use. A special case has been
added that will revert to this "auto-detect" logic, ie. if the "-engine"
switch is used as;
-engine auto
Dr. Stephen Henson [Fri, 28 Sep 2001 01:48:34 +0000 (01:48 +0000)]
Modernise and fix (ancient) "maurice" demos.
Dr. Stephen Henson [Fri, 28 Sep 2001 01:47:36 +0000 (01:47 +0000)]
Constify EVP_SealInit, EVP_OpenInit
Dr. Stephen Henson [Fri, 28 Sep 2001 00:47:36 +0000 (00:47 +0000)]
Make (ancient) sign.c demo compile again.
Dr. Stephen Henson [Fri, 28 Sep 2001 00:44:44 +0000 (00:44 +0000)]
Support fractional seconds in GeneralizedTime
Richard Levitte [Thu, 27 Sep 2001 16:07:36 +0000 (16:07 +0000)]
Synchronise with Unixly build.
Richard Levitte [Thu, 27 Sep 2001 15:43:55 +0000 (15:43 +0000)]
Stop thinking arguments starting with - are algorithm identifiers.
Show timing parameters and timing functions used.
It looks like some Linuxen have very weird settings for CLK_TCK. I'm
very unsure about this change and will investigate further.
Richard Levitte [Thu, 27 Sep 2001 15:41:34 +0000 (15:41 +0000)]
Apparently, Linux is identified with __linux__ as well.
Richard Levitte [Wed, 26 Sep 2001 15:23:14 +0000 (15:23 +0000)]
'make update'
Richard Levitte [Wed, 26 Sep 2001 15:18:32 +0000 (15:18 +0000)]
The #error message must match a very specific regexp (see mkdef.pl,
currently line 470).
Ben Laurie [Wed, 26 Sep 2001 15:15:03 +0000 (15:15 +0000)]
Don't clean up stuff twice.
Ben Laurie [Wed, 26 Sep 2001 15:14:10 +0000 (15:14 +0000)]
Fixes.
Richard Levitte [Wed, 26 Sep 2001 15:06:45 +0000 (15:06 +0000)]
Two changes:
1. if there are several symbols with the same entry number, sort those
symbols in ASCII order.
2. Do not stop reading the header files when "BEGIN ERROR CODES" is
found, since mkerr.pl will add a function declaration after that
comment. Instead, trigger on "Error codes for the \w+ function",
which is the actual start of the error code macros.
Additionally, a few more debugging printouts that helped.
Ben Laurie [Wed, 26 Sep 2001 11:38:57 +0000 (11:38 +0000)]
Fix warning.
Geoff Thorpe [Tue, 25 Sep 2001 21:52:39 +0000 (21:52 +0000)]
"FALLBACK" handling was a hack that was thrown out long ago in the
ENGINE redevelopment. The idea had been that "-1" could be used as a
special "ask me later" 'nid' rather than specifying supported cipher and
digest 'nid's up front. However the idea turned out to be pretty broken.
Geoff Thorpe [Tue, 25 Sep 2001 21:47:27 +0000 (21:47 +0000)]
Make update to bring in all the cipher/digest-related ENGINE changes.
NB: It looks like mkdef.pl is causing certain cvs wars by continually
flipping the order of some definitions ...
Geoff Thorpe [Tue, 25 Sep 2001 21:45:03 +0000 (21:45 +0000)]
Put the cipher info back into the "openssl engine" command.
Geoff Thorpe [Tue, 25 Sep 2001 21:44:12 +0000 (21:44 +0000)]
Fiddling.
Geoff Thorpe [Tue, 25 Sep 2001 21:43:08 +0000 (21:43 +0000)]
This change puts the original OpenBSD /dev/crypto support that was in
crypto/evp/ into the corresponding ENGINE. This code is currently untested.