Richard Levitte [Tue, 15 Jun 2004 11:46:06 +0000 (11:46 +0000)]
Typo, setting the first element of nids[] to NULL instead of setting
*cnids.
Lutz Jänicke [Mon, 14 Jun 2004 13:26:47 +0000 (13:26 +0000)]
More precise explanation of session id context requirements.
Richard Levitte [Thu, 27 May 2004 10:19:04 +0000 (10:19 +0000)]
Make sure o_str.h is reachable.
Richard Levitte [Thu, 27 May 2004 10:07:04 +0000 (10:07 +0000)]
Run an installation of FIPS stuff as well.
Richard Levitte [Thu, 27 May 2004 10:04:40 +0000 (10:04 +0000)]
Compile the FIPS directory on VMS as well. fips-lib.com is
essentially a copy of crypto-lib.com, with just a few edits.
Richard Levitte [Thu, 27 May 2004 09:33:10 +0000 (09:33 +0000)]
Copy the FIPS files to the temporary openssl include directory.
Richard Levitte [Wed, 19 May 2004 14:16:33 +0000 (14:16 +0000)]
Define FIPS_*_SIZE_T for AES, DSA and RSA as well, in preparation for
size_t-ification of those algorithms in future version of OpenSSL...
Andy Polyakov [Mon, 17 May 2004 15:37:26 +0000 (15:37 +0000)]
Make reservations in FIPS code for upcoming size_t-fication of OpenSSL API.
And couple of bug-fixes in fips/rand code [return without lock release and
incorrect return value in fips_rand_bytes].
Richard Levitte [Mon, 17 May 2004 04:47:26 +0000 (04:47 +0000)]
Typo corretced.
Richard Levitte [Mon, 17 May 2004 04:40:49 +0000 (04:40 +0000)]
Rewrite the usage to avoid confusion.
Richard Levitte [Mon, 17 May 2004 04:39:00 +0000 (04:39 +0000)]
Make it possible for the user to choose the digest used to create the
key.
Richard Levitte [Mon, 17 May 2004 04:31:14 +0000 (04:31 +0000)]
When in FIPS mode, use SHA1 to digest the key, rather than MD5, as MD5
isn't a FIPS-approved algorithm.
Note: this means the user needs to keep track of this, and we need to
add support for that...
Richard Levitte [Mon, 17 May 2004 04:30:06 +0000 (04:30 +0000)]
Make sure the applications know when we are running in FIPS mode. We
can't use the variable in libcrypto, since it's supposedly unknown.
Note: currently only supported in MONOLITH mode.
Richard Levitte [Mon, 17 May 2004 04:28:31 +0000 (04:28 +0000)]
Generate SHA1 files on Windows and other platforms supported by
mk1mf.pl, when building in FIPS mode.
Note: UNTESTED!
Ben Laurie [Sat, 15 May 2004 17:51:26 +0000 (17:51 +0000)]
Fix self-tests, ban some things in FIPS mode, fix copyrights.
Dr. Stephen Henson [Sat, 15 May 2004 17:46:50 +0000 (17:46 +0000)]
Fixes so alerts are sent properly in s3_pkt.c
PR: 851
Ben Laurie [Sat, 15 May 2004 16:39:23 +0000 (16:39 +0000)]
Check error returns.
Richard Levitte [Fri, 14 May 2004 17:55:59 +0000 (17:55 +0000)]
Reimplement old functions, so older software that link to libcrypto
don't crash and burn.
Richard Levitte [Fri, 14 May 2004 17:54:18 +0000 (17:54 +0000)]
All EVP_*_cfb functions have changed names to EVP_*_cfb64 or
EVP_*_cfb128.
Richard Levitte [Thu, 13 May 2004 22:41:01 +0000 (22:41 +0000)]
make update
Richard Levitte [Thu, 13 May 2004 22:40:40 +0000 (22:40 +0000)]
o_str.h is not an exported header.
Richard Levitte [Thu, 13 May 2004 22:40:08 +0000 (22:40 +0000)]
Synchronise o_str.c between 0.9.8-dev and 0.9.7-stable.
Richard Levitte [Thu, 13 May 2004 21:38:37 +0000 (21:38 +0000)]
make update
Richard Levitte [Thu, 13 May 2004 21:38:23 +0000 (21:38 +0000)]
Let's make life easier and have the VMS version of the configuration be
generated from the Unixly configuration file.
Dr. Stephen Henson [Wed, 12 May 2004 18:20:57 +0000 (18:20 +0000)]
Make self signing option of 'x509' use random serial numbers too.
Dr. Stephen Henson [Wed, 12 May 2004 17:53:22 +0000 (17:53 +0000)]
Fix memory leak.
Ben Laurie [Wed, 12 May 2004 14:11:10 +0000 (14:11 +0000)]
Blow up in people's faces if they don't reseed.
Richard Levitte [Wed, 12 May 2004 10:17:15 +0000 (10:17 +0000)]
make update
Richard Levitte [Wed, 12 May 2004 10:17:02 +0000 (10:17 +0000)]
Forgot to update the Makefile with the o_str stuff...
Richard Levitte [Wed, 12 May 2004 10:09:00 +0000 (10:09 +0000)]
The functions OPENSSL_strcasen?cmp() were forgotten when merging the
FIPS branch into this. It's needed at least for certain OpenVMS
versions, and should really be used in a more general way.
Richard Levitte [Wed, 12 May 2004 10:07:20 +0000 (10:07 +0000)]
Ignore 'Makefile.save'
Richard Levitte [Wed, 12 May 2004 08:46:43 +0000 (08:46 +0000)]
Ignore the 'lib' timestamp file.
Richard Levitte [Wed, 12 May 2004 08:42:55 +0000 (08:42 +0000)]
I forgot to modify the signature for fips_rand.c...
Richard Levitte [Wed, 12 May 2004 08:28:51 +0000 (08:28 +0000)]
Only really build this file when OPENSSL_FIPS is defined. And oh,
let's keep internal variables static.
Richard Levitte [Wed, 12 May 2004 08:28:00 +0000 (08:28 +0000)]
Makefile.ssl changed name to Makefile.
Richard Levitte [Wed, 12 May 2004 08:27:38 +0000 (08:27 +0000)]
Only check for FIPS signatures when FIPS is enabled.
Ben Laurie [Tue, 11 May 2004 12:46:24 +0000 (12:46 +0000)]
Pull FIPS back into stable.
Richard Levitte [Thu, 6 May 2004 09:46:48 +0000 (09:46 +0000)]
Remove the creation of $(INSTALL_PREFIX)$(OPENSSLDIR)/lib, since we don't
use it.
Notified by Frédéric L. W. Meunier <0@pervalidus.tk> in PR 713
Richard Levitte [Thu, 6 May 2004 09:31:31 +0000 (09:31 +0000)]
When the pointer 'from' changes, it's stored length needs to change as
well.
Notified by Frank Kardel <kardel@acm.org> in PR 879.
Bodo Möller [Tue, 4 May 2004 01:08:33 +0000 (01:08 +0000)]
update from current 0.9.6-stable CHANGES file
Dr. Stephen Henson [Thu, 22 Apr 2004 12:33:03 +0000 (12:33 +0000)]
Fix memory leak.
PR:870
Dr. Stephen Henson [Thu, 22 Apr 2004 12:19:48 +0000 (12:19 +0000)]
Port the random serial number generation to 0.9.7-stable.
Due to the changes in CA.pl in 0.9.8 (use of -self_sign) a slightly different
technique is used to ensure that 'ca' uses the next serial number. It
now initializes the serial number using 'openssl x509 -next_serial'.
Geoff Thorpe [Wed, 21 Apr 2004 15:09:25 +0000 (15:09 +0000)]
Extend the index parameter checking from sk_value to sk_set(). Also tidy up
some similar code elsewhere.
Thanks to Francesco Petruzzi for bringing this to my attention.
Dr. Stephen Henson [Thu, 15 Apr 2004 00:33:24 +0000 (00:33 +0000)]
Clear error if unique_subject lookup fails.
Dr. Stephen Henson [Tue, 13 Apr 2004 17:49:05 +0000 (17:49 +0000)]
Add some root CAs.
cvs2svn [Tue, 13 Apr 2004 17:47:38 +0000 (17:47 +0000)]
This commit was manufactured by cvs2svn to create branch
'OpenSSL_0_9_7-stable'.
Dr. Stephen Henson [Tue, 13 Apr 2004 17:47:37 +0000 (17:47 +0000)]
Add some root CAs.
Richard Levitte [Fri, 2 Apr 2004 12:39:54 +0000 (12:39 +0000)]
Typo. "pa-rics2W" corrected to "pa-risc2W".
PR: 868
Geoff Thorpe [Fri, 2 Apr 2004 06:25:53 +0000 (06:25 +0000)]
Avoid undefined results when the parameter is out of range.
Geoff Thorpe [Fri, 2 Apr 2004 06:25:11 +0000 (06:25 +0000)]
Avoid undefined results when the parameter is out of range.
Dr. Stephen Henson [Thu, 1 Apr 2004 22:23:46 +0000 (22:23 +0000)]
Don't use C++ reserved word.
Dr. Stephen Henson [Wed, 31 Mar 2004 12:55:33 +0000 (12:55 +0000)]
Oops forgot CHANGES entry.
Dr. Stephen Henson [Wed, 31 Mar 2004 12:17:24 +0000 (12:17 +0000)]
New function X509_POLICY_NODE_print()
Richard Levitte [Mon, 29 Mar 2004 08:13:49 +0000 (08:13 +0000)]
Add symbol hacks for some long names.
make update
Andy Polyakov [Sun, 28 Mar 2004 21:27:47 +0000 (21:27 +0000)]
This is essentially Intel 32-bit compiler tune-up. To start with all
available compiler versions generated bogus machine code trying to
compile new crypto/des/cfb_enc.c. Secondly, 8th version defines
__GNUC__ macro, but fails to compile *some* inline assembler correctly.
Note that all versions of icc implement MSC-like _lrot[rl] intrinsic,
which is used now instead of offensive asm. Finally, unnecessary linker
dependencies are eliminated. Most notably dependency from libirc.a
caused trouble at application start-up, if libcrypto.so is linked with
-Bsymbolic (which it is).
Dr. Stephen Henson [Sun, 28 Mar 2004 17:38:00 +0000 (17:38 +0000)]
Enhance EVP code to generate random symmetric keys of the
appropriate form, for example correct DES parity.
Update S/MIME code and EVP_SealInit to use new functions.
PR: 700
Dr. Stephen Henson [Sun, 28 Mar 2004 12:40:11 +0000 (12:40 +0000)]
Make {i2v,v2i}_ASN1_BIT_STRING global.
make update
Dr. Stephen Henson [Sun, 28 Mar 2004 12:29:53 +0000 (12:29 +0000)]
Obsolete files.
Dr. Stephen Henson [Sun, 28 Mar 2004 12:29:05 +0000 (12:29 +0000)]
Remove obsolete files.
Dr. Stephen Henson [Sat, 27 Mar 2004 22:49:28 +0000 (22:49 +0000)]
Allow CRLs to be passed into X509_STORE_CTX. This is useful when the
verified structure can contain its own CRLs (such as PKCS#7 signedData).
Tidy up some of the verify code.
Dr. Stephen Henson [Sat, 27 Mar 2004 13:30:14 +0000 (13:30 +0000)]
Extend OID config module format.
Dr. Stephen Henson [Fri, 26 Mar 2004 00:24:38 +0000 (00:24 +0000)]
Free up BIO properly when using streaming S/MIME sign.
Dr. Stephen Henson [Thu, 25 Mar 2004 23:32:06 +0000 (23:32 +0000)]
Remove BN_CTX debug from debug-steve
Richard Levitte [Thu, 25 Mar 2004 21:32:30 +0000 (21:32 +0000)]
SSL_COMP_get_compression_method is a typo (a missing 's' at the end of
the symbol name).
Richard Levitte [Thu, 25 Mar 2004 20:09:02 +0000 (20:09 +0000)]
Move the definition of Win32_rename(), since the macro rename gets undefined
in the middle of the code on Windows, and that disrupts operations in functions
later that use rename()...
PR: 853
Richard Levitte [Thu, 25 Mar 2004 20:09:00 +0000 (20:09 +0000)]
Move the definition of Win32_rename(), since the macro rename gets undefined
in the middle of the code on Windows, and that disrupts operations in functions
later that use rename()...
PR: 853
Richard Levitte [Thu, 25 Mar 2004 20:01:08 +0000 (20:01 +0000)]
Wrap code starting with a definition.
PR: 854
Richard Levitte [Thu, 25 Mar 2004 20:01:01 +0000 (20:01 +0000)]
Wrap code starting with a definition.
PR: 854
Richard Levitte [Thu, 25 Mar 2004 19:52:36 +0000 (19:52 +0000)]
Change spaces to symbols in names.
PR: 856
Richard Levitte [Thu, 25 Mar 2004 19:52:34 +0000 (19:52 +0000)]
Change spaces to symbols in names.
PR: 856
Richard Levitte [Thu, 25 Mar 2004 16:21:42 +0000 (16:21 +0000)]
Make prototypes for some callback pointers.
Richard Levitte [Thu, 25 Mar 2004 16:04:02 +0000 (16:04 +0000)]
A couple more cases where RAND_add() gets an integer instead of a
doule as last argument.
Richard Levitte [Thu, 25 Mar 2004 15:52:43 +0000 (15:52 +0000)]
RAND_add() wants a double as it's last argument.
Dr. Stephen Henson [Thu, 25 Mar 2004 13:45:58 +0000 (13:45 +0000)]
Fix loads of warnings in policy code.
I'll remember to try to compile this with warnings enabled next time :-)
Dr. Stephen Henson [Thu, 25 Mar 2004 13:37:02 +0000 (13:37 +0000)]
Fix ASN1 warnings.
Geoff Thorpe [Thu, 25 Mar 2004 04:32:24 +0000 (04:32 +0000)]
Adjust various bignum functions to use BN_CTX for variables instead of
locally initialising their own.
NB: I've removed the "BN_clear_free()" loops for the exit-paths in some of
these functions, and that may be a major part of the performance
improvements we're seeing. The "free" part can be removed because we're
using BN_CTX. The "clear" part OTOH can be removed because BN_CTX
destruction automatically performs this task, so performing it inside
functions that may be called repeatedly is wasteful. This is currently safe
within openssl due to the fact that BN_CTX objects are never created for
longer than a single high-level operation. However, that is only because
there's currently no mechanism in openssl for thread-local storage. Beyond
that, this might be an issue for applications using the bignum API directly
and caching their own BN_CTX objects. The solution is to introduce a flag
to BN_CTX_start() that allows its variables to be automatically sanitised
on release during BN_CTX_end(). This way any higher-level function (and
perhaps the application) can specify this flag in its own
BN_CTX_start()/BN_CTX_end() pair, and this will cause inner-loop functions
specifying the flag to be ignored so that sanitisation is handled only once
back out at the higher level. I will be implementing this in the near
future.
Geoff Thorpe [Thu, 25 Mar 2004 04:16:14 +0000 (04:16 +0000)]
Replace the BN_CTX implementation with my current work. I'm leaving the
little TODO list in there as well as the debugging code (only enabled if
BN_CTX_DEBUG is defined).
I'd appreciate as much review and testing as can be spared for this. I'll
commit some changes to other parts of the bignum code shortly to make
better use of this implementation (no more fixed size limitations). Note
also that under identical optimisations, I'm seeing a noticable speed
increase over openssl-0.9.7 - so any feedback to confirm/deny this on other
systems would also be most welcome.
Geoff Thorpe [Thu, 25 Mar 2004 03:03:52 +0000 (03:03 +0000)]
Adds warnings about two curves and fixes the "seed" value for two other
curves.
Submitted by: Nils Larsch
Geoff Thorpe [Thu, 25 Mar 2004 02:55:17 +0000 (02:55 +0000)]
... and this should likewise fix up those RSA implementations that weren't
already built and tested.
Geoff Thorpe [Thu, 25 Mar 2004 02:52:04 +0000 (02:52 +0000)]
By adding a BN_CTX parameter to the 'rsa_mod_exp' callback, private key
operations no longer require two distinct BN_CTX structures. This may put
more "strain" on the current BN_CTX implementation (which has a fixed limit
to the number of variables it will hold), but so far this limit is not
triggered by any of the tests pass and I will be changing BN_CTX in the
near future to avoid this problem anyway.
This also changes the default RSA implementation code to use the BN_CTX in
favour of initialising some of its variables locally in each function.
Geoff Thorpe [Thu, 25 Mar 2004 02:41:35 +0000 (02:41 +0000)]
Damn, I was a bit hasty with my fix and hadn't spotted the linker
dependency from asn1.
Geoff Thorpe [Thu, 25 Mar 2004 02:24:38 +0000 (02:24 +0000)]
Remove some warnings.
Geoff Thorpe [Thu, 25 Mar 2004 02:19:42 +0000 (02:19 +0000)]
Protect against gcc's "warning: cast does not match function type".
Dr. Stephen Henson [Thu, 25 Mar 2004 00:57:23 +0000 (00:57 +0000)]
Make S/MIME encrypt work again.
Richard Levitte [Wed, 24 Mar 2004 10:55:50 +0000 (10:55 +0000)]
Don't define fd for platforms that do not use it, as some may not declare fileno() properly
Richard Levitte [Wed, 24 Mar 2004 10:55:48 +0000 (10:55 +0000)]
Don't define fd for platforms that do not use it, as some may not declare fileno() properly
Richard Levitte [Wed, 24 Mar 2004 10:50:42 +0000 (10:50 +0000)]
Correct constness problems.
Richard Levitte [Wed, 24 Mar 2004 10:50:25 +0000 (10:50 +0000)]
Make it easier to buld test applications...
Richard Levitte [Wed, 24 Mar 2004 10:48:50 +0000 (10:48 +0000)]
Only build the PKCS#7 test applications if "pkcs7" is present in
SDIRS.
Richard Levitte [Wed, 24 Mar 2004 09:52:16 +0000 (09:52 +0000)]
Add store.h among the exported headers on VMS.
Richard Levitte [Wed, 24 Mar 2004 09:43:03 +0000 (09:43 +0000)]
o_str.h isn't a public header file, so make sure it will still be
included.
Richard Levitte [Wed, 24 Mar 2004 09:41:33 +0000 (09:41 +0000)]
o_str.h isn't a public header file.
Richard Levitte [Wed, 24 Mar 2004 09:40:59 +0000 (09:40 +0000)]
Typo...
Richard Levitte [Wed, 24 Mar 2004 09:40:23 +0000 (09:40 +0000)]
Make sure toupper() is properly declared.
Richard Levitte [Tue, 23 Mar 2004 21:01:42 +0000 (21:01 +0000)]
Make it clear that for RSA_NO_PADDING, flen must be RSA_size(rsa)
Richard Levitte [Tue, 23 Mar 2004 21:01:34 +0000 (21:01 +0000)]
Make it clear that for RSA_NO_PADDING, flen must be RSA_size(rsa)
Richard Levitte [Tue, 23 Mar 2004 17:52:25 +0000 (17:52 +0000)]
make update
Richard Levitte [Tue, 23 Mar 2004 15:06:33 +0000 (15:06 +0000)]
make update
Richard Levitte [Tue, 23 Mar 2004 14:50:16 +0000 (14:50 +0000)]
Sync the VMS build with Unix.
Dr. Stephen Henson [Tue, 23 Mar 2004 14:14:35 +0000 (14:14 +0000)]
Initial support for certificate policy checking and evaluation.
This is currently *very* experimental and needs to be more fully integrated
with the main verification code.