Richard Levitte [Sat, 12 Mar 2016 09:46:14 +0000 (10:46 +0100)]
Use single quotes rather than double quotes when needed
When passing down values to Makefile.shared, do so with single quotes
as much as possible to avoid having the shell create a mess of quotes.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Sat, 12 Mar 2016 08:38:20 +0000 (09:38 +0100)]
Harmonize Unix Makefile template with Windows dito
The variable SHARED_CFLAGS and SHARD_LDFLAGS were used in the Unix
template because they normally contain options used when building
"shared". The Windows template, on the other hand, uses LIB_CFLAGS,
to express the intended use of those flags rather than their content.
The Windows template still used SHARED_LDFLAGS, which seems
inconsistent.
To harmonize the two, any SHARED_CFLAGS gets renamed to LIB_CFLAGS and
SHARED_LDFLAGS to LIB_LDFLAGS. That makes the intent consistent along
with BIN_{C,LD}FLAGS and DSO_{C,LD}FLAGS.
Finally, make sure to pass down $(LIB_CFLAGS) or $(DSO_CFLAGS) along
with $(CFLAGS) when using Makefile.shared.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Emilia Kasper [Sat, 12 Mar 2016 19:46:13 +0000 (20:46 +0100)]
Fix memory leak in library deinit
ENGINE_cleanup calls CRYPTO_free_ex_data and therefore,
CRYPTO_cleanup_all_ex_data - which cleans up the method pointers - must
run after ENGINE_cleanup.
Additionally, don't needlessly initialize the EX_CALLBACKS stack during
e.g. CRYPTO_free_ex_data. The only time this is actually needed is when
reserving the first ex data index. Specifically, since sk_num returns -1
on NULL input, the rest of the code already handles a NULL method stack
correctly.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Thu, 10 Mar 2016 15:37:31 +0000 (10:37 -0500)]
Add doc on when to use SCT callback.
With help from Viktor.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Emilia Kasper [Sat, 12 Mar 2016 16:18:25 +0000 (17:18 +0100)]
Workaround for false -Warray-bounds in Travis
ccache + clang produces a false strcmp warning, see
https://llvm.org/bugs/show_bug.cgi?id=20144
Since this only happens with ccache and --strict-warnings, and
only with certain versions of glibc / clang, disabling
ccache is a reasonable short-term workaround.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Emilia Kasper [Fri, 11 Mar 2016 20:13:19 +0000 (21:13 +0100)]
Fix no-comp build
Reviewed-by: Matt Caswell <matt@openssl.org>
Rich Salz [Sat, 12 Mar 2016 01:36:33 +0000 (20:36 -0500)]
Fix build break; add function declaration
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Sat, 12 Mar 2016 01:06:55 +0000 (02:06 +0100)]
When creating directory specs, use srctop_dir rather than srctop_file.
While insignificant on Unix like systems, this is significant on
systems like VMS.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Richard Levitte [Sat, 12 Mar 2016 00:06:48 +0000 (01:06 +0100)]
Avoid sed for dependency post-processing
It turns out that different sed implementations treat -i differently
to cause issues. make it simpler by avoiding it entirely and give
perl the trust to be consistent enough.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Fri, 11 Mar 2016 18:22:58 +0000 (19:22 +0100)]
Because bn_expand2 is declared non-static, it must not be static
That doesn't change even to make a dummy to hide its unavailability.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Fri, 11 Mar 2016 21:05:02 +0000 (21:05 +0000)]
Remove some dead code from 1999
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Fri, 11 Mar 2016 16:47:42 +0000 (16:47 +0000)]
Don't clobber the last error
On Windows we call WSAGetLastError() to find out the last error that
happened on a socket operation. We use this to find out whether we can
retry the operation or not. You are supposed to call this immediately
however in a couple of places we logged an error first. This can end up
making other Windows system calls to get the thread local error state.
Sometimes that can clobber the error code, so if you call WSAGetLastError()
later on you get a spurious response and the socket operation looks like
a fatal error.
Really we shouldn't be logging an error anyway if its a retryable issue.
Otherwise we could end up with stale errors on the error queue.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mat [Fri, 11 Mar 2016 19:20:20 +0000 (20:20 +0100)]
removed extra define
verified that build succeeds without the extra define
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Mat [Fri, 11 Mar 2016 17:26:57 +0000 (18:26 +0100)]
Fix no-blake2 for Windows classic build
Fix no-blake2 for Windows classic build
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Fri, 11 Mar 2016 17:41:24 +0000 (17:41 +0000)]
make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Thu, 10 Mar 2016 15:04:46 +0000 (15:04 +0000)]
Make X509_SIG opaque.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Fri, 11 Mar 2016 12:25:48 +0000 (13:25 +0100)]
Some sed implementations are not greedy enough, use perl instead
The issue is demonstrated as follows:
On Linux:
$ echo ': foo.h /usr/include/stddef.h bar.h' | sed -e 's/ \/\(\\.\|[^ ]\)*//g'
: foo.h bar.h
On MacOS X:
$ echo ': foo.h /usr/include/stddef.h bar.h' | sed -e 's/ \/\(\\.\|[^ ]\)*//g'
: foo.husr/include/stddef.h bar.h
Perl is more consistent:
On Linux:
$ echo ': foo.h /usr/include/stddef.h bar.h' | perl -pe 's/ \/(\\.|[^ ])*//g;'
: foo.h bar.h
On MacOS X:
$ echo ': foo.h /usr/include/stddef.h bar.h' | perl -pe 's/ \/(\\.|[^ ])*//g;'
: foo.h bar.h
Reviewed-by: Andy Polyakov <appro@openssl.org>
Rich Salz [Fri, 11 Mar 2016 15:38:45 +0000 (10:38 -0500)]
Make update to catch function renames.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Kurt Roeckx [Fri, 11 Mar 2016 00:19:43 +0000 (01:19 +0100)]
Use unsigned int instead of just unsigned.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Kurt Roeckx [Fri, 11 Mar 2016 00:06:51 +0000 (01:06 +0100)]
Save leaf_node and node_offset as character array
They are not numbers in the machine byte order.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Kurt Roeckx [Wed, 9 Mar 2016 23:49:55 +0000 (00:49 +0100)]
Review comments
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Bill Cox [Wed, 9 Mar 2016 22:08:31 +0000 (23:08 +0100)]
Add blake2 support.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Dr. Stephen Henson [Thu, 10 Mar 2016 14:24:39 +0000 (14:24 +0000)]
move DSA_SIG definition into C source file
Reviewed-by: Rich Salz <rsalz@openssl.org>
Andy Polyakov [Fri, 11 Mar 2016 12:44:46 +0000 (13:44 +0100)]
crypto/*/build.info: make it work on ARM platforms.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Fri, 11 Mar 2016 11:04:15 +0000 (12:04 +0100)]
crypto/*/build.info: SPARC-specific fixups.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Fri, 11 Mar 2016 10:55:44 +0000 (11:55 +0100)]
Configurations/unix-Makefile.tmpl: don't leave empty .s files behind.
If pre-processor failed, an empty .s file could be left behind,
which could get successfully compiled if one simply re-ran make
and cause linking failures. Not anymore. Remove even intermediate .S
in case of pre-processor failure.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Andy Polyakov [Fri, 11 Mar 2016 11:33:59 +0000 (12:33 +0100)]
Configure: remove dependency on 'head'.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rob Percival [Thu, 10 Mar 2016 23:26:41 +0000 (23:26 +0000)]
constify CT_POLICY_EVAL_CTX getters
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Thu, 10 Mar 2016 23:10:02 +0000 (23:10 +0000)]
Surround ctx_set_ctlog_list_file() with #ifndef OPENSSL_NO_CT
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Fri, 11 Mar 2016 13:50:55 +0000 (13:50 +0000)]
Suppress CT warnings in test_ssl
Running test_ssl with HARNESS_VERBOSE results in lots of spurious warnings
about an inability to load the CT config file. This fixes it.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Fri, 11 Mar 2016 10:38:14 +0000 (11:38 +0100)]
Avoid getting unresolved referense to bn_expand2 in test/bntest.c
Issue identified on Solaris by Erik Forsberg <erik@efca.com>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Fri, 11 Mar 2016 09:52:52 +0000 (09:52 +0000)]
Call CONF_modules_free() before ENGINE_cleanup() in auto-deinit
During auto de-init we were calling ENGINE_cleanup(), and then later
CONF_modules_free(). However the latter function can end up calling
engine code, which can lead to a use of the global_engine_lock after it
has already been freed. Therefore we should swap the calling order of
these two functions.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Mat [Fri, 11 Mar 2016 03:52:32 +0000 (04:52 +0100)]
Fix no-rmd160 classic Windows build
no-ripemd was unified a while ago but the change was not done in mk1mf.pl. This commit changes the no-ripemd string to no-rmd160 which fixes the no-rmd160 classic build.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Fri, 11 Mar 2016 11:58:15 +0000 (12:58 +0100)]
Don't build dynamic engines unless configured "shared"
Experience has shown that dynamic engines with their own copy of
libcrypto is problematic, so we disable that possibility.
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Fri, 11 Mar 2016 08:26:49 +0000 (09:26 +0100)]
Harmonise the two methods to generate dependency files
One of them didn't clean away .d.tmp files properly.
The other would overwrite the .d files unconditionally, thereby
causing a possibly unnecessary dependency rebuild, which touches the
date of Makefile, which causes a possibly unnecessary rebuild of
buildinf.h and everything that depends on that.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Matt Caswell [Thu, 10 Mar 2016 11:05:47 +0000 (11:05 +0000)]
More tweaks to the installation instructions
A few things were out of date and a few things were missing. Also some
formatting updates.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 23:49:47 +0000 (00:49 +0100)]
Fix some assembler generating scripts for better unification
Some of these scripts would recognise an output parameter if it looks
like a file path. That works both in both the classic and new build
schemes. Some fo these scripts would only recognise it if it's a
basename (i.e. no directory component). Those need to be corrected,
as the output parameter in the new build scheme is more likely to
contain a directory component than not.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 20:55:12 +0000 (21:55 +0100)]
Add include directory options for assembler files that include from crypto/
A few were missed in the previous commit.
Closes RT#4412
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Thu, 10 Mar 2016 19:49:34 +0000 (19:49 +0000)]
check reviewer --reviewer=emilia
Use SSL_get_SSL_CTX instead of passing SSL_CTX to s_client.c:print_stuff
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Thu, 10 Mar 2016 18:21:40 +0000 (18:21 +0000)]
check reviewer --reviewer=emilia
Pass entire CTLOG_STORE to SCT_print, rather than just the SCT's CTLOG
SCT_print now looks up the correct CT log for you.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Thu, 10 Mar 2016 18:17:23 +0000 (18:17 +0000)]
check reviewer --reviewer=emilia
Remove 'log' field from SCT and related accessors
In order to still have access to an SCT's CTLOG when calling SCT_print,
SSL_CTX_get0_ctlog_store has been added.
Improved documentation for some CT functions in openssl/ssl.h.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 19:05:52 +0000 (20:05 +0100)]
Add include directory options for assembler files that include from crypto/
Closes RT#4406
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 18:34:21 +0000 (19:34 +0100)]
In the recipe using "makedepend", make sure the object file extension is there
Reviewed-by: Stephen Henson <steve@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 18:33:11 +0000 (19:33 +0100)]
Configure - don't trust $1 to stick around, save its value away
Reviewed-by: Stephen Henson <steve@openssl.org>
Matt Caswell [Thu, 10 Mar 2016 15:17:20 +0000 (15:17 +0000)]
Fix a memory leak in the afalg engine
The AFALG engine created a global EVP_CIPHER instance but was not freeing
it up when the engine was destroyed.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 13:20:50 +0000 (14:20 +0100)]
Harmonize the option processing in 'config' and 'config.com'
The help text for -d in 'config' was aged, and the option processing
in 'config.com' was just different. This harmonizes 'config.com' with
the instructions in INSTALL and both current reality.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 00:51:53 +0000 (01:51 +0100)]
Add cleaning targets to Configurations/windows-makefile.tmpl
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 10:29:08 +0000 (11:29 +0100)]
The typedef ECPARAMETERS is already defined, don't define it anew
Reviewed-by: Matt Caswell <matt@openssl.org>
David Woodhouse [Sat, 20 Feb 2016 15:07:32 +0000 (15:07 +0000)]
Allow OPENSSL_NO_SOCK in e_os.h even for non-Windows/DOS platforms
UEFI needs this too. Don't keep it only in the Windows/DOS ifdef block.
This is a fixed version of what was originally commit
963bb62195 and
subsequently reverted in commit
37b1f8bd62. Somewhere along the way, the
Windows/DOS ifdef actually got removed, leaving it just broken. It should
have been turned into an #elif, not removed.
This one correctly changes the logic from
# if WINDOWS|DOS
# if OPENSSL_NO_SOCK
... no-sock ...
# elif !DJGPP
... native windows ...
to
# if OPENSSL_NO_SOCK
... no-sock ...
# elif WINDOWS|DOS
# if !DJGPP
... native windows ...
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Matt Caswell [Thu, 10 Mar 2016 09:21:23 +0000 (09:21 +0000)]
Remove a missed item from the old thread API
A line from cryptlib.h was missed during the old Thread API removal. This
breaks no-deprecated builds.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Thu, 10 Mar 2016 09:20:06 +0000 (09:20 +0000)]
Mark SRP_VBASE_get_by_user() as deprecated
The function SRP_VBASE_get_by_user() is declared as deprecated but the
implementation was not.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Matt Caswell [Thu, 10 Mar 2016 09:18:50 +0000 (09:18 +0000)]
No need to call EVP_CIPHER_CTX_init after EVP_CIPHER_CTX_new
The afalgtest was unnecessarily initing an EVP_CIPHER_CTX. It is not
needed and is deprecated.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 08:04:09 +0000 (09:04 +0100)]
Pass down inclusion directories to source file generators
The source file generators sometimes use $(CC) to post-process
generated source, and getting the inclusion directories may be
necessary at times, so we pass them down.
RT#4406
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 07:36:57 +0000 (08:36 +0100)]
Travis - add missing semi-colon
Reviewed-by: Rich Salz <rsalz@openssl.org>
Todd Short [Sat, 5 Mar 2016 12:29:10 +0000 (07:29 -0500)]
Update .gitignore to ignore all cscope files
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Viktor Szakats [Wed, 9 Mar 2016 14:38:06 +0000 (15:38 +0100)]
remove ms/.rnd and add it to .gitignore
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Rich Salz [Thu, 10 Mar 2016 01:56:43 +0000 (20:56 -0500)]
RT3676 add: Export ASN.1 DHparams
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 01:14:55 +0000 (02:14 +0100)]
Travis - don't use ccache with cross compiles
Although theoretically possible, Configure doesn't treat CC variable
set like this very well: CC="ccache i686-w64-mingw32-gcc"
Also, this Travis script doesn't recognise the possibility either.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Benjamin Kaduk [Tue, 8 Mar 2016 22:44:57 +0000 (16:44 -0600)]
Avoid negative array index in BIO_debug_callback()
BIO_snprintf() can return -1 on truncation (and overflow as of commit
9cb177301fdab492e4cfef376b28339afe3ef663). Though neither can
realistically occur while printing a pointer and short fixed string into
a buffer of length 256, the analysis to confirm that this the case goes
somewhat far up the call chain, and not all static analyzers can
successfully follow the chain of logic.
It's easy enough to clamp the returned length to be nonnegative before
continuing, which appeases the static analyzer and does not harm the
subsequent code.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Benjamin Kaduk [Tue, 8 Mar 2016 21:53:49 +0000 (15:53 -0600)]
CT: check some GeneralizedTime return values
Some of the ASN.1 routines for the GeneralizedTime type can return
errors; check for these and do not continue past failure, so as
to appease coverity.
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 00:58:27 +0000 (01:58 +0100)]
When configured "shared", don't build static libraries on Windows
The reason for this is that the static libraries and the DLL import
libraries are named the same on Windows. When configured "shared",
the static libraries are unused anyway.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 01:03:51 +0000 (02:03 +0100)]
Make util/mk1mf.pl recognise no-weak-ssl-ciphers
Reviewed-by: Rich Salz <rsalz@openssl.org>
Jim Basney [Wed, 9 Mar 2016 23:11:49 +0000 (17:11 -0600)]
Avoid double-free in calleres to OCSP_parse_url
set pointers to NULL after OPENSSL_free before returning to caller to
avoid possible double-free in caller
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Mat [Thu, 10 Mar 2016 01:29:02 +0000 (02:29 +0100)]
Fix return type for CRYPTO_THREAD_run_once
return type should be int and not void
Signed-off-by: Rich Salz <rsalz@akamai.com>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Viktor Dukhovni [Tue, 8 Mar 2016 20:20:02 +0000 (15:20 -0500)]
Add X509_CHECK_FLAG_NEVER_CHECK_SUBJECT flag
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Richard Levitte [Thu, 10 Mar 2016 01:23:34 +0000 (02:23 +0100)]
Remove duplicate typedef of ECPKPARAMETERS in ec.h
Reviewed-by: Stephen Henson <steve@openssl.org>
Kurt Roeckx [Wed, 9 Mar 2016 21:54:16 +0000 (22:54 +0100)]
Run make update
Reviewed-by: Rich Salz <rsalz@openssl.org>
MR: #2296
Richard Levitte [Thu, 10 Mar 2016 00:31:06 +0000 (01:31 +0100)]
Travis - the source directory is _srcdist, not _srcdir
Reviewed-by: Stephen Henson <steve@openssl.org>
Richard Levitte [Wed, 9 Mar 2016 22:58:44 +0000 (23:58 +0100)]
Correct slight logic error in processing IF in build.info
This corrects a fault where the inner IF in this example was still
being acted upon:
IF[0]
...whatever...
IF[1]
...whatever more...
ENDIF
ENDIF
With this change, the inner IF is skipped over.
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Wed, 9 Mar 2016 21:34:27 +0000 (22:34 +0100)]
When grepping something starting with a dash, remember to use -e
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Kurt Roeckx [Wed, 2 Mar 2016 21:39:40 +0000 (22:39 +0100)]
Deprecate the use of version-specific methods
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1824
Kurt Roeckx [Wed, 2 Mar 2016 21:38:08 +0000 (22:38 +0100)]
Use version flexible method instead of fixed version
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1824
Kurt Roeckx [Tue, 2 Feb 2016 22:58:49 +0000 (23:58 +0100)]
Use minimum and maximum protocol version instead of version fixed methods
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1824
Kurt Roeckx [Tue, 2 Feb 2016 22:16:20 +0000 (23:16 +0100)]
Fix usage of OPENSSL_NO_*_METHOD
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1824
Kurt Roeckx [Tue, 8 Mar 2016 19:26:38 +0000 (20:26 +0100)]
Move disabling of RC4 for DTLS to the cipher list.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Wed, 9 Mar 2016 17:30:43 +0000 (18:30 +0100)]
Remove DES cipher alias
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:34:03 +0000 (20:34 +0100)]
Update ciphers -s documentation
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:33:43 +0000 (20:33 +0100)]
Document SSL_get1_supported_ciphers
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:20:01 +0000 (20:20 +0100)]
IDEA is not supported in TLS 1.2
This currently seems to be the only cipher we still support that should get
disabled.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:17:07 +0000 (20:17 +0100)]
Add support for minimum and maximum protocol version supported by a cipher
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:07:21 +0000 (20:07 +0100)]
Add ssl_get_client_min_max_version() function
Adjust ssl_set_client_hello_version to get both the minimum and maximum and then
make ssl_set_client_hello_version use the maximum version.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:11:56 +0000 (20:11 +0100)]
Make SSL_CIPHER_get_version return a const char *
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 16:52:22 +0000 (17:52 +0100)]
Remove unused code
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:56:40 +0000 (20:56 +0100)]
Make function to convert version to string
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Kurt Roeckx [Sun, 7 Feb 2016 19:44:27 +0000 (20:44 +0100)]
Constify security callbacks
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1595
Rob Percival [Wed, 9 Mar 2016 03:12:25 +0000 (03:12 +0000)]
Documentation for ctx_set_ctlog_list_file()
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Fri, 4 Mar 2016 19:07:25 +0000 (19:07 +0000)]
Minor improvement to formatting of SCT output in s_client
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Fri, 4 Mar 2016 19:06:43 +0000 (19:06 +0000)]
Do not display a CT log error message if CT validation is disabled
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rich Salz [Wed, 9 Mar 2016 16:56:42 +0000 (11:56 -0500)]
RT3676: Expose ECgroup i2d functions
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
Richard Levitte [Wed, 9 Mar 2016 16:18:07 +0000 (17:18 +0100)]
Comment away the extra checks in Configure
The "extra checks" is a debugging tool to check the config resolving
mechanism. It uses Perl's smart match, which is experimental and
therefore always causes Perl to give out a warning, and it causes
older Perl versions to fail entirely.
So, it gets commented away, but stays otherwise in place, as it may be
useful again.
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Wed, 9 Mar 2016 16:24:34 +0000 (17:24 +0100)]
Make ct_dir and certs_dir static in test/ct_test.c
Reviewed-by: Matt Caswell <matt@openssl.org>
Richard Levitte [Wed, 9 Mar 2016 13:10:05 +0000 (14:10 +0100)]
Fix ct_test to not assume it's in the source directory
ct_test assumed it's run in the source directory and failed when built
elsewhere. It still defaults to that, but can be told another story
with the environment variables CT_DIR and CERTS_DIR.
Test recipe updated to match.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Wed, 9 Mar 2016 15:23:58 +0000 (15:23 +0000)]
Document importance of CTLOG_STORE outliving SCT if SCT_set0_log is used
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Wed, 9 Mar 2016 02:46:15 +0000 (02:46 +0000)]
Make SCT literals into const variables in ct_test.c
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Tue, 8 Mar 2016 19:20:22 +0000 (19:20 +0000)]
Makes STACK_OF(SCT)* parameter of i2d_SCT_LIST const
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Tue, 8 Mar 2016 19:09:06 +0000 (19:09 +0000)]
Removes SCT_LIST_set_source and SCT_LIST_set0_logs
Both of these functions can easily be implemented by callers instead.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Tue, 8 Mar 2016 18:58:03 +0000 (18:58 +0000)]
Makes SCT_get0_log return const CTLOG*
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Tue, 8 Mar 2016 18:55:55 +0000 (18:55 +0000)]
Makes CTLOG_STORE_get0_log_by_id return const CTLOG*
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Tue, 8 Mar 2016 18:37:16 +0000 (18:37 +0000)]
Improved documentation of SCT_CTX_* functions
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Rob Percival [Tue, 8 Mar 2016 18:07:10 +0000 (18:07 +0000)]
Updates ct_err.c
Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>