Lutz Jänicke [Fri, 20 Jul 2001 18:58:25 +0000 (18:58 +0000)]
Some more documentation bits.
cvs2svn [Fri, 20 Jul 2001 18:57:16 +0000 (18:57 +0000)]
This commit was manufactured by cvs2svn to create branch
'OpenSSL_0_9_6-stable'.
Lutz Jänicke [Fri, 20 Jul 2001 18:57:15 +0000 (18:57 +0000)]
Some more documentation bits.
Geoff Thorpe [Fri, 20 Jul 2001 15:16:10 +0000 (15:16 +0000)]
Currently, RSA code, when using no padding scheme, simply checks that input
does not contain more bytes than the RSA modulus 'n' - it does not check
that the input is strictly *less* than 'n'. Whether this should be the
case or not is open to debate - however, due to security problems with
returning miscalculated CRT results, the 'rsa_mod_exp' implementation in
rsa_eay.c now performs a public-key exponentiation to verify the CRT result
and in the event of an error will instead recalculate and return a non-CRT
(more expensive) mod_exp calculation. As the mod_exp of 'I' is equivalent
to the mod_exp of 'I mod n', and the verify result is automatically between
0 and n-1 inclusive, the verify only matches the input if 'I' was less than
'n', otherwise even a correct CRT calculation is only congruent to 'I' (ie.
they differ by a multiple of 'n'). Rather than rejecting correct
calculations and doing redundant and slower ones instead, this changes the
equality check in the verification code to a congruence check.
Andy Polyakov [Tue, 17 Jul 2001 14:39:26 +0000 (14:39 +0000)]
Missing line 0.9.6b release and IA-64 patch advertisement:-)
Richard Levitte [Mon, 16 Jul 2001 10:50:49 +0000 (10:50 +0000)]
SSL_get_rfc were documented but not implemented.
Richard Levitte [Mon, 16 Jul 2001 10:50:29 +0000 (10:50 +0000)]
SSL_get_rfc were documented but not implemented.
Richard Levitte [Sun, 15 Jul 2001 20:12:45 +0000 (20:12 +0000)]
SSL_get_[rw]fd were documented but not implemented.
Richard Levitte [Sun, 15 Jul 2001 20:11:57 +0000 (20:11 +0000)]
SSL_get_[rw]fd were documented but not implemented.
Dr. Stephen Henson [Fri, 13 Jul 2001 13:13:44 +0000 (13:13 +0000)]
Allow OCSP server to handle multiple requests.
Document new OCSP options.
Dr. Stephen Henson [Thu, 12 Jul 2001 20:41:51 +0000 (20:41 +0000)]
Initial OCSP server support, using index.txt format.
This can process internal requests or behave like a
mini responder.
Todo: documentation, update usage info.
Richard Levitte [Thu, 12 Jul 2001 16:17:33 +0000 (16:17 +0000)]
Prevent KSSL server from requesting a client certificate.
Submitted by Jeffrey Altman <jaltman@columbia.edu>
Richard Levitte [Thu, 12 Jul 2001 15:54:10 +0000 (15:54 +0000)]
paddr may be NULL. Do not crash if it is.
Richard Levitte [Thu, 12 Jul 2001 09:19:34 +0000 (09:19 +0000)]
Clarify that zlib-dynamic is the default choice.
Richard Levitte [Thu, 12 Jul 2001 09:11:14 +0000 (09:11 +0000)]
Add the possibility to specify the use of zlib compression and
decompression. It can be set up to link at link time or to load the
zlib library at run-time.
Lutz Jänicke [Thu, 12 Jul 2001 08:54:17 +0000 (08:54 +0000)]
Clarify actual state.
Lutz Jänicke [Thu, 12 Jul 2001 08:53:50 +0000 (08:53 +0000)]
Clarify actual state.
Richard Levitte [Thu, 12 Jul 2001 08:51:47 +0000 (08:51 +0000)]
Some of the Kerberos code had dissapeared. Reapply.
Richard Levitte [Thu, 12 Jul 2001 04:23:57 +0000 (04:23 +0000)]
Document the recent Kerberos SSL changes.
Dr. Stephen Henson [Wed, 11 Jul 2001 22:54:24 +0000 (22:54 +0000)]
Delete extra ;
Dr. Stephen Henson [Wed, 11 Jul 2001 22:42:20 +0000 (22:42 +0000)]
In ocsp_match_issuerid() we are passed the CA that signed the responder
certificate so need to match its subject with the certificate IDs in the
response.
Richard Levitte [Wed, 11 Jul 2001 21:15:03 +0000 (21:15 +0000)]
make update
Note that since some private kssl functions were exported, the
simplest way to rebuild the number table was to toss everything that
was new since OpenSSL 0.9.6b. This is safe, since those functions
have not yet been exported in an OpenSSL release. Beware, people who
trust intermediary snapshots!
Richard Levitte [Wed, 11 Jul 2001 21:11:40 +0000 (21:11 +0000)]
Include kssl_lcl.h where needed.
Richard Levitte [Wed, 11 Jul 2001 21:09:30 +0000 (21:09 +0000)]
Private functions do not belong in an exported header file, so move
them to one that won't get exported.
Richard Levitte [Wed, 11 Jul 2001 19:03:58 +0000 (19:03 +0000)]
Changes to the Kerberos SSL code by Jeffrey Altman <jaltman@columbia.edu>
His comments are:
. adds use of replay cache to protect against replay attacks
. adds functions kssl_tgt_is_available() and
kssl_keytab_is_available() which are used within s3_lib.c
and ssl_lib.c to determine at runtime whether or not
KRB5 ciphers can be supported during the current session.
Geoff Thorpe [Wed, 11 Jul 2001 18:59:25 +0000 (18:59 +0000)]
openssl speed is quite useful for testing hardware support (among other
things), especially as the RSA keys are fixed. However, DSA only fixes the
DSA parameters and then generates the public and private components on the
fly each time - this commit hard-codes some sampled key values so that this
is no longer the case.
Richard Levitte [Wed, 11 Jul 2001 16:13:36 +0000 (16:13 +0000)]
Code to avoid the use of non-standard strptime(). By
Jeffrey Altman <jaltman@columbia.edu>
(Really, the time that's being parsed is a GeneralizedTime, so if
ASN1_GENERALIZEDTIME_get() ever gets implemented, it should be used
instead)
Lutz Jänicke [Wed, 11 Jul 2001 15:51:13 +0000 (15:51 +0000)]
What is an '-engine' version?
Lutz Jänicke [Wed, 11 Jul 2001 15:49:35 +0000 (15:49 +0000)]
Typo...
Richard Levitte [Wed, 11 Jul 2001 15:31:45 +0000 (15:31 +0000)]
Changes to the Kerberos SSL code by Jeffrey Altman <jaltman@columbia.edu>
His comments are:
. Fixed all of the Windows dynamic loading functions, prototypes, etc.
. Corrected all of the unsigned/signed comparison warnings
. Replaced the references to krb5_cksumarray[] for two reasons.
First, it was an internal variable that should not have been
referenced outside the library; nor could it have been with
a shared library with restricted exports. Second, the
variable is no longer used in current Kerberos implementations.
I replaced the code with equivalent functionality using functions
that are exported from the library.
Lutz Jänicke [Wed, 11 Jul 2001 15:31:21 +0000 (15:31 +0000)]
What is an '-engine' version?
Richard Levitte [Wed, 11 Jul 2001 15:29:33 +0000 (15:29 +0000)]
The implementation of the TKTBODY ASN.1 functions was missing.
Richard Levitte [Wed, 11 Jul 2001 15:16:15 +0000 (15:16 +0000)]
make update
Richard Levitte [Wed, 11 Jul 2001 15:15:31 +0000 (15:15 +0000)]
Make sure crypto/krb5/krb5_asn.h is copied to the directory of
exported header files.
Richard Levitte [Wed, 11 Jul 2001 15:14:22 +0000 (15:14 +0000)]
Make sure crypto/krb5/krb5_asn.h becomes part of libeay.num.
Lutz Jänicke [Wed, 11 Jul 2001 15:11:26 +0000 (15:11 +0000)]
Clarify! (based on recent mailing-list discussions)
Lutz Jänicke [Wed, 11 Jul 2001 15:10:28 +0000 (15:10 +0000)]
Clarify! (based on recent mailing-list discussions)
Richard Levitte [Wed, 11 Jul 2001 07:10:43 +0000 (07:10 +0000)]
One forgotten function.
Richard Levitte [Tue, 10 Jul 2001 21:00:37 +0000 (21:00 +0000)]
make update
Richard Levitte [Tue, 10 Jul 2001 20:58:13 +0000 (20:58 +0000)]
EVP_Digest() takes one more parameter.
Bodo Möller [Tue, 10 Jul 2001 11:41:29 +0000 (11:41 +0000)]
For consistency with the terminology used in my SAC2001 paper, avoid
the term "simultaneous multiplication" (which -- acording to the
paper, at least -- applies only to certain methods which we don't use
here)
Bodo Möller [Tue, 10 Jul 2001 11:28:53 +0000 (11:28 +0000)]
comment change
Bodo Möller [Tue, 10 Jul 2001 10:49:34 +0000 (10:49 +0000)]
Fix PRNG.
Bodo Möller [Tue, 10 Jul 2001 10:04:26 +0000 (10:04 +0000)]
In version numbers, there is just one "M" nybble.
Bodo Möller [Tue, 10 Jul 2001 10:04:05 +0000 (10:04 +0000)]
Precomputation will not necessarily be LIm-Lee precomputation.
Richard Levitte [Mon, 9 Jul 2001 21:51:03 +0000 (21:51 +0000)]
If I define _XOPEN_SOURCE before including *any* system header file,
things will work much more smoothly.
Richard Levitte [Mon, 9 Jul 2001 21:46:58 +0000 (21:46 +0000)]
Patches from Vern Staats <staatsvr@asc.hpc.mil> to get Kerberos 5 in
SSL according to RFC 2712. His comment is:
This is a patch to openssl-SNAP-
20010702 to support Kerberized SSL
authentication. I'm expecting to have the full kssl-0.5 kit up on
sourceforge by the end of the week. The full kit includes patches
for mod-ssl, apache, and a few text clients. The sourceforge URL
is http://sourceforge.net/projects/kssl/ .
Thanks to a note from Simon Wilkinson I've replaced my KRB5 AP_REQ
message with a real KerberosWrapper struct. I think this is fully
RFC 2712 compliant now, including support for the optional
authenticator field. I also added openssl-style ASN.1 macros for
a few Kerberos structs; see crypto/krb5/ if you're interested.
Ben Laurie [Mon, 9 Jul 2001 21:00:36 +0000 (21:00 +0000)]
A better compromise between encrypt and decrypt (but why isn't it as fast
for encrypt?).
Richard Levitte [Mon, 9 Jul 2001 15:10:56 +0000 (15:10 +0000)]
Tagging has been done, move on to 0.9.6c-dev.
Richard Levitte [Mon, 9 Jul 2001 14:36:30 +0000 (14:36 +0000)]
Add security patch and create release.
Tags will be OpenSSL_0_9_6b and OpenSSL-engine-0_9_6b
Ben Laurie [Sun, 8 Jul 2001 19:42:10 +0000 (19:42 +0000)]
Handle the common case first (where input size is a multiple of block size).
Worth around 5% for encrypt. Slows down decrypt slightly, but I expect to
regain that later.
Ben Laurie [Sun, 8 Jul 2001 17:27:32 +0000 (17:27 +0000)]
Use & instead of % - worth about 4% for 8 byte blocks.
Ben Laurie [Sun, 8 Jul 2001 12:58:10 +0000 (12:58 +0000)]
Don't update argc, argv for decrypt flag!
Ben Laurie [Sun, 8 Jul 2001 12:14:41 +0000 (12:14 +0000)]
Speed test decrypt EVP operations.
Ben Laurie [Sun, 8 Jul 2001 11:42:38 +0000 (11:42 +0000)]
Correct const-ness.
Ben Laurie [Fri, 6 Jul 2001 22:06:08 +0000 (22:06 +0000)]
Remove unnecessary casts.
Ben Laurie [Fri, 6 Jul 2001 21:35:00 +0000 (21:35 +0000)]
Constification.
Richard Levitte [Thu, 5 Jul 2001 12:28:13 +0000 (12:28 +0000)]
make update
Richard Levitte [Thu, 5 Jul 2001 10:20:07 +0000 (10:20 +0000)]
Use one address consistently.
Richard Levitte [Thu, 5 Jul 2001 10:19:13 +0000 (10:19 +0000)]
Change info to correct values.
Bodo Möller [Wed, 4 Jul 2001 20:56:47 +0000 (20:56 +0000)]
Align with 0.9.6-stable CHANGES file, and make some corrections.
Bodo Möller [Wed, 4 Jul 2001 20:56:08 +0000 (20:56 +0000)]
Engine memory leaks have been fixed by now.
Bodo Möller [Wed, 4 Jul 2001 20:55:36 +0000 (20:55 +0000)]
Call ENGINE_cleanup() to avoid memory leak.
Bodo Möller [Wed, 4 Jul 2001 20:17:52 +0000 (20:17 +0000)]
Andy's mips3.s fix (as in main branch).
Bodo Möller [Wed, 4 Jul 2001 20:17:27 +0000 (20:17 +0000)]
Entry for Andy's mips3.s fix.
Ben Laurie [Wed, 4 Jul 2001 12:26:39 +0000 (12:26 +0000)]
Update nCipher header with more liberal licence.
Lutz Jänicke [Tue, 3 Jul 2001 10:32:30 +0000 (10:32 +0000)]
When only the key is given to "enc", the IV is undefined
(found by Andy Brown <logic@warthog.com>).
Lutz Jänicke [Tue, 3 Jul 2001 10:31:11 +0000 (10:31 +0000)]
When only the key is given to "enc", the IV is undefined
(found by Andy Brown <logic@warthog.com>).
Richard Levitte [Tue, 3 Jul 2001 01:43:11 +0000 (01:43 +0000)]
Make an extra note about shared libraries and backward compatibility.
Richard Levitte [Mon, 2 Jul 2001 20:43:01 +0000 (20:43 +0000)]
Let's include cryptlib.h *before* things like NO_SYSLOG are tested or
used.
Richard Levitte [Mon, 2 Jul 2001 20:41:05 +0000 (20:41 +0000)]
[Forgotten commits?]
Changes to have OpenSSL compile on OS/2.
Contributed by "Brian Havard" <brianh@kheldar.apana.org.au>
Ben Laurie [Mon, 2 Jul 2001 12:50:30 +0000 (12:50 +0000)]
Fix warning.
Richard Levitte [Sun, 1 Jul 2001 23:15:43 +0000 (23:15 +0000)]
Insuline shot
Richard Levitte [Sun, 1 Jul 2001 22:39:46 +0000 (22:39 +0000)]
Changes to have OpenSSL compile on OS/2.
Contributed by "Brian Havard" <brianh@kheldar.apana.org.au>
Dr. Stephen Henson [Thu, 28 Jun 2001 11:41:50 +0000 (11:41 +0000)]
Modify apps to use NCONF code instead of old CONF code.
Add new extension functions which work with NCONF.
Tidy up extension config routines and remove redundant code.
Fix NCONF_get_number().
Todo: more testing of apps to see they still work...
Richard Levitte [Wed, 27 Jun 2001 09:12:43 +0000 (09:12 +0000)]
Make better use of load_cert, load_certs and load_key.
Dr. Stephen Henson [Tue, 26 Jun 2001 12:39:22 +0000 (12:39 +0000)]
Another empty X509_NAME fix.
Dr. Stephen Henson [Tue, 26 Jun 2001 12:38:33 +0000 (12:38 +0000)]
Another empty X509_NAME fix.
Dr. Stephen Henson [Tue, 26 Jun 2001 12:04:35 +0000 (12:04 +0000)]
Handle empty X509_NAME in printing routines.
Dr. Stephen Henson [Tue, 26 Jun 2001 12:04:12 +0000 (12:04 +0000)]
Handle empty X509_NAME in printing routines.
Bodo Möller [Tue, 26 Jun 2001 09:48:56 +0000 (09:48 +0000)]
DSA verification should insist that r and s are in the allowed range.
Bodo Möller [Tue, 26 Jun 2001 09:48:17 +0000 (09:48 +0000)]
DSA verification should insist that r and s are in the allowed range.
Richard Levitte [Mon, 25 Jun 2001 14:23:36 +0000 (14:23 +0000)]
Make better use of load_cert, load_certs and load_key.
Richard Levitte [Mon, 25 Jun 2001 14:12:45 +0000 (14:12 +0000)]
Make get_ip() a bit more strict in it's parsing of IP addresses, and
at the same time a bit more accepting with host names.
Richard Levitte [Mon, 25 Jun 2001 14:00:47 +0000 (14:00 +0000)]
Make better use of load_cert, load_certs and load_key.
Bodo Möller [Mon, 25 Jun 2001 10:09:55 +0000 (10:09 +0000)]
Translate into valid C (don't call functions with wrong prototypes).
Richard Levitte [Mon, 25 Jun 2001 08:35:59 +0000 (08:35 +0000)]
Call apps_shutdown() to take down what apps_startup() set up.
Richard Levitte [Sun, 24 Jun 2001 07:00:41 +0000 (07:00 +0000)]
Make sure we don't return 0 on error.
Dr. Stephen Henson [Sat, 23 Jun 2001 23:07:34 +0000 (23:07 +0000)]
In {RSA,DSA,DH}_new_method(x) need to increase the reference
count of the ENGINE is x is not NULL since it will be freed
in {RSA,DSA,DH}_free().
Richard Levitte [Sat, 23 Jun 2001 16:46:14 +0000 (16:46 +0000)]
Use the new UI features, among others the new boolean input.
NOTE: Boolean input hasn't been very well tested yet, so this part may
fail miserably.
Richard Levitte [Sat, 23 Jun 2001 16:44:15 +0000 (16:44 +0000)]
Including stdio.h before setting _XOPEN_SOURCE and
_XOPEN_SOURCE_EXTENDED wasn't very smart...
Richard Levitte [Sat, 23 Jun 2001 16:43:03 +0000 (16:43 +0000)]
make update
Richard Levitte [Sat, 23 Jun 2001 16:37:32 +0000 (16:37 +0000)]
Use apps_shutdown() in all applications, in case someone decides not
to go the monolith way (does anyone do that these days?).
NOTE: a few applications are missing in this commit. I've a few more
changes in them that I haven't tested yet.
Richard Levitte [Sat, 23 Jun 2001 16:31:41 +0000 (16:31 +0000)]
apps_startup() needs a corresponding apps_shutdown().
Richard Levitte [Sat, 23 Jun 2001 16:30:14 +0000 (16:30 +0000)]
Make use of new features in UI's. Among others, the application
password callbak doesn't need to check for sizes any more.
Richard Levitte [Sat, 23 Jun 2001 16:28:21 +0000 (16:28 +0000)]
Oops, applies to 0.9.7 only.
Richard Levitte [Sat, 23 Jun 2001 16:27:37 +0000 (16:27 +0000)]
Document recent changes.
Richard Levitte [Sat, 23 Jun 2001 16:25:56 +0000 (16:25 +0000)]
Do not loop i the OpenSSL UI method any more. Instead, letthe
application do that.
NOTE: there's no requirement for other UI_METHODs to avoid this kind
of loop. For example, a GUI UI_METHOD would probably check the
lengths of the answers from within instead of being constantly
redisplayed for everything that is wrong.
Richard Levitte [Sat, 23 Jun 2001 16:23:17 +0000 (16:23 +0000)]
make update
Richard Levitte [Sat, 23 Jun 2001 16:22:48 +0000 (16:22 +0000)]
Implement boolean (yes/no or OK/Cancel, ...) input.
Implement UI controls. Current controls are the possibility to output
the OpenSSL error stack on the same channel from within UI_process()
and to check if the same user interface can be redone without being
rebuilt (this is often more a question of philosophy than
technicalities).