Dr. Stephen Henson [Thu, 23 Aug 2001 23:54:11 +0000 (23:54 +0000)]
Load OCSP responder key before waiting for an incoming
connection so it can prompt for pass phrase on startup
instead of after the first connection.
Add -port switch to usage message.
Dr. Stephen Henson [Thu, 23 Aug 2001 23:52:38 +0000 (23:52 +0000)]
Add #ifdefs to some devcrypto code
Lutz Jänicke [Thu, 23 Aug 2001 17:41:20 +0000 (17:41 +0000)]
Typo.
Lutz Jänicke [Thu, 23 Aug 2001 17:22:43 +0000 (17:22 +0000)]
More manual pages. Constify.
Lutz Jänicke [Thu, 23 Aug 2001 15:00:11 +0000 (15:00 +0000)]
As discussed recently on openssl-users.
Lutz Jänicke [Thu, 23 Aug 2001 09:42:12 +0000 (09:42 +0000)]
Make clear, that using the compression layer is currently not recommended.
Ulf Möller [Wed, 22 Aug 2001 18:35:17 +0000 (18:35 +0000)]
typo.
Ben Laurie [Wed, 22 Aug 2001 16:09:57 +0000 (16:09 +0000)]
More tests.
Lutz Jänicke [Tue, 21 Aug 2001 14:54:54 +0000 (14:54 +0000)]
One more manual page...
Lutz Jänicke [Tue, 21 Aug 2001 13:02:58 +0000 (13:02 +0000)]
Documentation on how to handle compression methods.
Hopefully it is clear enough, that it is currently not recommended.
Lutz Jänicke [Tue, 21 Aug 2001 07:27:02 +0000 (07:27 +0000)]
Checked in from the wrong !@#$%&*() copy...
Lutz Jänicke [Mon, 20 Aug 2001 14:34:16 +0000 (14:34 +0000)]
More interdependencies with respect to shutdown behaviour.
Lutz Jänicke [Sun, 19 Aug 2001 16:20:42 +0000 (16:20 +0000)]
Alert description strings for TLSv1 and documentation.
Ben Laurie [Sat, 18 Aug 2001 16:04:36 +0000 (16:04 +0000)]
Add RC4 support to OpenBSD.
Ben Laurie [Sat, 18 Aug 2001 16:02:52 +0000 (16:02 +0000)]
Add AES tests.
Ben Laurie [Sat, 18 Aug 2001 13:53:01 +0000 (13:53 +0000)]
Add EVP test program.
Ben Laurie [Sat, 18 Aug 2001 10:22:54 +0000 (10:22 +0000)]
Add first cut symmetric crypto support.
Lutz Jänicke [Fri, 17 Aug 2001 16:36:51 +0000 (16:36 +0000)]
More details about session timeout settings.
Lutz Jänicke [Fri, 17 Aug 2001 15:54:50 +0000 (15:54 +0000)]
One more function documented.
Lutz Jänicke [Fri, 17 Aug 2001 15:09:31 +0000 (15:09 +0000)]
SSL_shutdown() has even more properties...
Lutz Jänicke [Fri, 17 Aug 2001 14:32:38 +0000 (14:32 +0000)]
One more step on the way for complete documentation...
Lutz Jänicke [Fri, 17 Aug 2001 09:08:32 +0000 (09:08 +0000)]
Unidirectional shutdown is allowed according to the RFC.
Richard Levitte [Fri, 17 Aug 2001 04:35:58 +0000 (04:35 +0000)]
Make sure evil file name characters, like spaces or ampersands (!),
don't disturb the rehashing process.
Spotted and suggested patch from Rudo Thomas <rudo@internet.sk>
Dr. Stephen Henson [Fri, 17 Aug 2001 01:09:54 +0000 (01:09 +0000)]
Make -passin -passout etc work again.
Fix leak in ca.c when using -passin.
Dr. Stephen Henson [Fri, 17 Aug 2001 00:33:43 +0000 (00:33 +0000)]
Add CRL utility functions to allow CRLs to be
built up without accessing structures directly.
Update ca.c to use new functions.
Fix ca.c so it now build CRLs correctly again.
Lutz Jänicke [Thu, 16 Aug 2001 15:28:00 +0000 (15:28 +0000)]
Bugfixes provided by "Stephen Hinton" <shinton@netopia.com>.
Lutz Jänicke [Thu, 16 Aug 2001 14:27:55 +0000 (14:27 +0000)]
Better description of the behaviour of SSL_shutdown() as it is now, broken
or not.
Richard Levitte [Mon, 13 Aug 2001 14:09:31 +0000 (14:09 +0000)]
gcc 3.0 tells me that -m486 is deprecated. The gcc 2.95 manual tells
me the same and that the correct option is -mcpu=i486. I'm assuming
-mcpu has been around for some time, and that it's therefore safe to
change all occurences of -m486 to -mcpu=i486.
Geoff Thorpe [Sun, 12 Aug 2001 17:14:35 +0000 (17:14 +0000)]
The indexes returned by ***_get_ex_new_index() functions are used when
setting stack (actually, array) values in ex_data. So only increment the
global counters if the underlying CRYPTO_get_ex_new_index() call succeeds.
This change doesn't make "ex_data" right (see the comment at the head of
ex_data.c to know why), but at least makes the source code marginally less
frustrating.
Geoff Thorpe [Sun, 12 Aug 2001 16:52:00 +0000 (16:52 +0000)]
The indexes returned by ***_get_ex_new_index() functions are used when
setting stack (actually, array) values in ex_data. So only increment the
global counters if the underlying CRYPTO_get_ex_new_index() call succeeds.
This change doesn't make "ex_data" right (see the comment at the head of
ex_data.c to know why), but at least makes the source code marginally less
frustrating.
Ben Laurie [Sat, 11 Aug 2001 11:32:54 +0000 (11:32 +0000)]
Move CIPHER_CTX cleanups to _Final routines instead of _Init, which avoids
problems with leaks and uninitialised structures.
Richard Levitte [Fri, 10 Aug 2001 15:26:21 +0000 (15:26 +0000)]
Apply the Tru64 patch from Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu>
His comments are:
1) Changes all references for `True64' to be `Tru64', which is the correct
spelling for the OS name.
2) Makes `alpha-cc' be the same as `alpha164-cc', and adds an `alphaold-cc'
entry that is the same as the previous `alpha-cc'. The reason is that most
people these days are using the newer compiler, so it should be the default.
3) Adds a bit of commentary to Configure, regarding the name changes of
the OS over the years, so it's not so confusing to people that haven't been
with the OS for a while.
4) Adds an `alpha-cc-rpath' target (which is *not* selected automatically
by Configure under any circumstance) that builds an RPATH into the
shared libraries. This is explained in the comment in Configure. It's
very very useful for people that want it, and people that don't want it
just shouldn't choose that target.
5) Adds the `-pthread' flag as the best way to get POSIX thread support
from the newer compiler.
6) Updates the Makefile targets, so that when the `alpha164-cc', `alpha-cc',
or `alpha-cc-rpath' target is what Configure is set to use, it uses a Makefile
target that includes the `-msym' option when building the shared library.
This is a performance enhancement.
7) Updates `config' so that if it detects you're running version 4 or 5
of the OS, it automatically selects `alpha-cc', but uses `alphaold-cc'
for versions 1-3 of the OS.
8) Updates the comment in opensslv.h, fixing both the OS name typo and
adding a reference to IRIX 6.x, since the shared library semantics are
virtually identical there.
Bodo Möller [Wed, 8 Aug 2001 15:09:06 +0000 (15:09 +0000)]
add missing link
Bodo Möller [Tue, 7 Aug 2001 09:30:18 +0000 (09:30 +0000)]
Bugfix: larger message size in ssl3_get_key_exchange() because
ServerKeyExchange message may be skipped.
Submitted by: Petr Lampa <lampa@fee.vutbr.cz>
Lutz Jänicke [Tue, 7 Aug 2001 07:52:53 +0000 (07:52 +0000)]
Fix typos (shinagawa@star.zko.dec.com)
Bodo Möller [Mon, 6 Aug 2001 11:57:08 +0000 (11:57 +0000)]
More typedef'd struct names as search targets
Bodo Möller [Mon, 6 Aug 2001 11:49:31 +0000 (11:49 +0000)]
Reinsert typedef'ed names for structs to help those trying to read the
sourcecode (including fgrep)
Ben Laurie [Sun, 5 Aug 2001 18:02:16 +0000 (18:02 +0000)]
Start to reduce some of the header bloat.
Ben Laurie [Sun, 5 Aug 2001 16:13:49 +0000 (16:13 +0000)]
Fix memory leak.
Ben Laurie [Sat, 4 Aug 2001 12:16:56 +0000 (12:16 +0000)]
Parameter correction for CIOFSESSION.
Ben Laurie [Fri, 3 Aug 2001 21:09:21 +0000 (21:09 +0000)]
Remove extra whitespace. Sorry.
Ben Laurie [Fri, 3 Aug 2001 19:00:43 +0000 (19:00 +0000)]
Reinstate accidentally deleted code.
Ben Laurie [Fri, 3 Aug 2001 18:52:50 +0000 (18:52 +0000)]
Get rid of the stuff we, err, got rid of.
Ben Laurie [Fri, 3 Aug 2001 18:48:35 +0000 (18:48 +0000)]
Header bloat reduction for EVP_PKEY.
Ben Laurie [Fri, 3 Aug 2001 18:45:35 +0000 (18:45 +0000)]
This ghastly hack prevents CVS wars over Kerberos (which is disabled by default).
Lutz Jänicke [Fri, 3 Aug 2001 13:05:44 +0000 (13:05 +0000)]
Oops, one SSL_OP_NON_EXPORT_FIRST was left.
Ben Laurie [Fri, 3 Aug 2001 11:54:37 +0000 (11:54 +0000)]
Make /dev/crypto work with new EVP structures.
Richard Levitte [Fri, 3 Aug 2001 10:54:00 +0000 (10:54 +0000)]
Make sure memcpy() gets properly declared by including string.h.
Bodo Möller [Fri, 3 Aug 2001 09:28:02 +0000 (09:28 +0000)]
remove a comma
Lutz Jänicke [Fri, 3 Aug 2001 08:45:13 +0000 (08:45 +0000)]
Don't disable rollback attack detection as a recommended bug workaround.
Lutz Jänicke [Wed, 1 Aug 2001 10:07:55 +0000 (10:07 +0000)]
Mention removed option.
Lutz Jänicke [Wed, 1 Aug 2001 10:06:32 +0000 (10:06 +0000)]
Remove SSL_OP_NON_EXPORT_FIRST:
It did not work, it was deactivated by #if 0/#endif anyway _and_ we now have
the working SSL_OP_CIPHER_SERVER_PREFERENCE.
Richard Levitte [Tue, 31 Jul 2001 17:07:24 +0000 (17:07 +0000)]
make update
Richard Levitte [Tue, 31 Jul 2001 17:02:44 +0000 (17:02 +0000)]
Make sure the source file is included among the dependencies. This is
the norm for 'gcc -M' but not for 'makedepend', and is merely
introduced here to avoid commit wars.
Lutz Jänicke [Tue, 31 Jul 2001 15:04:50 +0000 (15:04 +0000)]
Reworked manual pages with a lot of input from Bodo Moeller.
Ben Laurie [Tue, 31 Jul 2001 13:33:58 +0000 (13:33 +0000)]
Document DES changes better.
Ben Laurie [Tue, 31 Jul 2001 12:03:26 +0000 (12:03 +0000)]
Remove old unused stuff.
Lutz Jänicke [Tue, 31 Jul 2001 10:19:20 +0000 (10:19 +0000)]
Indent.
Richard Levitte [Tue, 31 Jul 2001 09:15:52 +0000 (09:15 +0000)]
Vade retro C++ comments!
(Latin for "comments", anyone?)
Richard Levitte [Tue, 31 Jul 2001 08:50:20 +0000 (08:50 +0000)]
Make as sure as possible that gethostname() will be properly declared.
Richard Levitte [Tue, 31 Jul 2001 08:45:40 +0000 (08:45 +0000)]
Correct most of the unsigned vs. signed warnings (or int vs. size_t),
and rename some local variables to avoid name shadowing.
Richard Levitte [Tue, 31 Jul 2001 08:44:28 +0000 (08:44 +0000)]
Whoops, my fault, a backslash got converted to a slash...
Richard Levitte [Tue, 31 Jul 2001 07:21:06 +0000 (07:21 +0000)]
More Kerberos SSL changes from Jeffrey Altman <jaltman@columbia.edu>
His comments are:
First, it corrects a problem introduced in the last patch where the
kssl_map_enc() would intentionally return NULL for valid ENCTYPE
values. This was done to prevent verification of the kerberos 5
authenticator from being performed when Derived Key ciphers were
in use. Unfortunately, the authenticator verification routine was
not the only place that function was used. And it caused core dumps.
Second, it attempt to add to SSL_SESSION the Kerberos 5 Client
Principal Name.
Ben Laurie [Tue, 31 Jul 2001 06:47:23 +0000 (06:47 +0000)]
Remove //.
Richard Levitte [Tue, 31 Jul 2001 06:40:10 +0000 (06:40 +0000)]
make update
Ben Laurie [Mon, 30 Jul 2001 23:57:25 +0000 (23:57 +0000)]
Really add the EVP and all of the DES changes.
Ben Laurie [Mon, 30 Jul 2001 17:46:22 +0000 (17:46 +0000)]
Make EVPs allocate context memory, thus making them extensible. Rationalise
DES's keyschedules.
I know these two should be separate, and I'll back out the DES changes if they
are deemed to be an error.
Note that there is a memory leak lurking in SSL somewhere in this version.
Ben Laurie [Mon, 30 Jul 2001 17:17:26 +0000 (17:17 +0000)]
Only set the verify callback if there's one to set!
Andy Polyakov [Mon, 30 Jul 2001 16:46:37 +0000 (16:46 +0000)]
Just a "get to know your system" bit.
Andy Polyakov [Mon, 30 Jul 2001 16:42:15 +0000 (16:42 +0000)]
Enhanced support for IA-64 Linux and HP-UX (as well as better support for
HP-UX in common in ./config). Note that for the moment of this writing
none of 64-bit platforms pass bntest. I'm committing this anyway as it's
too frustrating to patch snapshots over and over while 0.9.6 is known to
work.
Andy Polyakov [Mon, 30 Jul 2001 15:54:13 +0000 (15:54 +0000)]
Support for Intel and HP-UXi assemblers.
Ben Laurie [Mon, 30 Jul 2001 15:33:46 +0000 (15:33 +0000)]
ANSIfication.
Andy Polyakov [Mon, 30 Jul 2001 14:33:58 +0000 (14:33 +0000)]
Typo in stty command lines.
Lutz Jänicke [Mon, 30 Jul 2001 11:50:37 +0000 (11:50 +0000)]
Don't miss files...
Lutz Jänicke [Mon, 30 Jul 2001 11:45:34 +0000 (11:45 +0000)]
Fix inconsistent behaviour with respect to verify_callback handling.
Lutz Jänicke [Mon, 30 Jul 2001 11:33:53 +0000 (11:33 +0000)]
Forgot to mention second fix.
Bodo Möller [Fri, 27 Jul 2001 22:45:35 +0000 (22:45 +0000)]
length of secret exponent is needed only when we create one
Bodo Möller [Fri, 27 Jul 2001 22:34:25 +0000 (22:34 +0000)]
Undo DH_generate_key() change: s3_srvr.c was using it correctly
Lutz Jänicke [Fri, 27 Jul 2001 12:35:27 +0000 (12:35 +0000)]
Another uninitialized static that may lead to problems on Solaris under some
circumstances.
Richard Levitte [Fri, 27 Jul 2001 07:47:51 +0000 (07:47 +0000)]
Addapt VMS script to the latest changes in the makefiles.
Dr. Stephen Henson [Fri, 27 Jul 2001 02:24:47 +0000 (02:24 +0000)]
Make sure *outl is always initialized in EVP_EncryptUpdate().
Dr. Stephen Henson [Fri, 27 Jul 2001 02:22:42 +0000 (02:22 +0000)]
More linker bloat reorganisation:
Split private key PEM and normal PEM handling. Private key
handling needs to link in stuff like PKCS#8.
Relocate the ASN1 *_dup() functions, to the relevant ASN1
modules using new macro IMPLEMENT_ASN1_DUP_FUNCTION. Previously
these were all in crypto/x509/x_all.c along with every ASN1
BIO/fp function which linked in *every* ASN1 function if
a single dup was used.
Move the authority key id ASN1 structure to a separate file.
This is used in the X509 routines and its previous location
linked in all the v3 extension code.
Also move ASN1_tag2bit to avoid linking in a_bytes.c which
is now largely obsolete.
So far under Linux stripped binary with single PEM_read_X509
is now 238K compared to 380K before these changes.
Dr. Stephen Henson [Thu, 26 Jul 2001 22:34:45 +0000 (22:34 +0000)]
First of several reorganisations to
reduce linker bloat. For example the
single line:
PEM_read_X509()
results in a binary of around 400K in Linux!
This first step separates some of the PEM functions and
avoids linking in some PKCS#7 and PKCS#12 code.
Lutz Jänicke [Thu, 26 Jul 2001 09:02:44 +0000 (09:02 +0000)]
Fix problem occuring when used from OpenSSH on Solaris 8.
Bodo Möller [Wed, 25 Jul 2001 17:48:51 +0000 (17:48 +0000)]
DH key generation should not use a do ... while loop,
or bogus DH parameters can be used for launching DOS attacks
Bodo Möller [Wed, 25 Jul 2001 17:20:34 +0000 (17:20 +0000)]
Don't preserve existing keys in DH_generate_key.
Bodo Möller [Wed, 25 Jul 2001 17:17:24 +0000 (17:17 +0000)]
md_rand.c thread safety
Bodo Möller [Wed, 25 Jul 2001 17:02:58 +0000 (17:02 +0000)]
always reject data >= n
Andy Polyakov [Wed, 25 Jul 2001 15:58:57 +0000 (15:58 +0000)]
Support for 64-bit Solaris build with GCC 3.0 and later. It should be
explicitely noted that 64-bit SPARCv9 ABI is not officially supported
by GCC 3.0 (support is scheduled for 3.1 release), but it appears to
work, at the very least 'make test' passes...
Lutz Jänicke [Wed, 25 Jul 2001 12:12:51 +0000 (12:12 +0000)]
Fix wrong information about SSL_set_connect_state()...
Bodo Möller [Wed, 25 Jul 2001 10:04:14 +0000 (10:04 +0000)]
add a comment
Bodo Möller [Tue, 24 Jul 2001 14:20:36 +0000 (14:20 +0000)]
avoid warnings
Bodo Möller [Tue, 24 Jul 2001 12:31:14 +0000 (12:31 +0000)]
Avoid race condition.
Submitted by: Travis Vitek <vitek@roguewave.com>
Geoff Thorpe [Mon, 23 Jul 2001 19:03:48 +0000 (19:03 +0000)]
- New INSTALL document describing different ways to build "tunala" and
possible problems.
- New file breakage.c handles (so far) missing functions.
- Get rid of some signed/unsigned/const warnings thanks to solaris-cc
- Add autoconf/automake input files, and helper scripts to populate missing
(but auto-generated) files.
This change adds a configure.in and Makefile.am to build everything using
autoconf, automake, and libtool - and adds "gunk" scripts to generate the
various files those things need (and clean then up again after). This means
that "autogunk.sh" needs to be run first on a system with the autotools,
but the resulting directory should be "configure"able and compilable on
systems without those tools.
Lutz Jänicke [Mon, 23 Jul 2001 12:57:37 +0000 (12:57 +0000)]
Additional inline reference.
Lutz Jänicke [Mon, 23 Jul 2001 12:52:05 +0000 (12:52 +0000)]
Add missing reference.
Geoff Thorpe [Sun, 22 Jul 2001 23:21:33 +0000 (23:21 +0000)]
Tidy up "cvs update" output a bit.
Richard Levitte [Sat, 21 Jul 2001 11:54:24 +0000 (11:54 +0000)]
Not all platforms have the OpenBSD crypto device.
Lutz Jänicke [Sat, 21 Jul 2001 11:02:17 +0000 (11:02 +0000)]
Documentation about ephemeral key exchange
Ben Laurie [Sat, 21 Jul 2001 10:24:07 +0000 (10:24 +0000)]
Clean up EVP macros, rename DES EDE3 modes correctly, temporary support for
OpenBSD /dev/crypto (this will be revamped later when the appropriate machinery
is available).