- 08 3月, 2016 2 次提交
-
-
由 Matt Caswell 提交于
Add the options min_send_frag and max_pipelines to s_server and s_client in order to control pipelining capabilities. This will only have an effect if a pipeline capable cipher is used (such as the one provided by the dasync engine). Reviewed-by: NTim Hudson <tjh@openssl.org>
-
由 Rich Salz 提交于
This replaces SHUTDOWN/SHUTDOWN2 with BIO_closesocket. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 04 3月, 2016 1 次提交
-
-
由 Rob Percival 提交于
Reviewed-by: NBen Laurie <ben@openssl.org> Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 28 2月, 2016 1 次提交
-
-
由 Rich Salz 提交于
Now that BIO_sock_nbio is available, use it in the apps. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 23 2月, 2016 2 次提交
-
-
由 Rich Salz 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Emilia Kasper 提交于
Explicitly unpoison the result of FD_ZERO Tests now pass, using -fsanitize=memory Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 20 2月, 2016 1 次提交
-
-
由 Kurt Roeckx 提交于
Also gives an error message when you gave it a parameter it didn't expect. Reviewed-by: NRich Salz <rsalz@openssl.org> MR: #2009
-
- 19 2月, 2016 1 次提交
-
-
由 Rich Salz 提交于
enc: - typo in -base64 option - missing help opt text ocsp, req, rsautl, s_client: - missing help opt text Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 17 2月, 2016 1 次提交
-
-
由 Rich Salz 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 15 2月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
On some platforms, the implementation is such that a signed char triggers a warning when used with is*() functions. On others, the behavior is outright buggy when presented with a char that happens to get promoted to a negative integer. The safest thing is to cast the char that's used to an unsigned char. Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 09 2月, 2016 3 次提交
-
-
由 Matt Caswell 提交于
This builds on the previous commit to auto initialise/deinitialise libcrypto. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Viktor Dukhovni 提交于
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 04 2月, 2016 1 次提交
-
-
由 Richard Levitte 提交于
s_socket.c gets brutally cleaned out and now consists of only two functions, one for client and the other for server. They both handle AF_INET, AF_INET6 and additionally AF_UNIX where supported. The rest is just easy adaptation. Both s_client and s_server get the new flags -4 and -6 to force the use of IPv4 or IPv6 only. Also, the default host "localhost" in s_client is removed. It's not certain that this host is set up for both IPv4 and IPv6. For example, Debian has "ip6-localhost" as the default hostname for [::1]. The better way is to default |host| to NULL and rely on BIO_lookup() to return a BIO_ADDRINFO with the appropriate loopback address for IPv4 or IPv6 as indicated by the |family| parameter. Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
- 29 1月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
This extends the existing async functionality to SSL_shutdown(), i.e. SSL_shutdown() can now casuse an SSL_ERROR_WANT_ASYNC error to be returned from SSL_get_error() if async mode has been enabled. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 21 1月, 2016 1 次提交
-
-
由 Viktor Dukhovni 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 19 1月, 2016 1 次提交
-
-
由 Viktor Dukhovni 提交于
Some users want to disable SSL 3.0/TLS 1.0/TLS 1.1, and enable just TLS 1.2. In the future they might want to disable TLS 1.2 and enable just TLS 1.3, ... This commit makes it possible to disable any or all of the TLS or DTLS protocols. It also considerably simplifies the SSL/TLS tests, by auto-generating the min/max version tests based on the set of supported protocols (425 explicitly written out tests got replaced by two loops that generate all 425 tests if all protocols are enabled, fewer otherwise). Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 15 1月, 2016 1 次提交
-
-
由 Rich Salz 提交于
It turns out that -pause calls the undocumented function SSL_set_debug. That just sets flag inside the SSL structure. That flag, despite the command is never used. So remove the flag, the field, and the function. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 09 1月, 2016 2 次提交
-
-
由 Rich Salz 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
由 Rich Salz 提交于
Make some local variables and a table of them be static. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 08 1月, 2016 1 次提交
-
-
由 Viktor Dukhovni 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 22 12月, 2015 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 15 12月, 2015 2 次提交
-
-
由 Matt Caswell 提交于
s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 12 12月, 2015 1 次提交
-
-
由 Kurt Roeckx 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 25 11月, 2015 1 次提交
-
-
由 Quanah Gibson-Mount 提交于
Signed-off-by: NKurt Roeckx <kurt@roeckx.be> Reviewed-by: NRich Salz <rsalz@akamai.com> GH: #481
-
- 21 11月, 2015 4 次提交
-
-
由 Matt Caswell 提交于
In theory the pthreads approach for Thread Local Storage should be more portable. This also changes some APIs in order to accommodate this change. In particular ASYNC_init_pool is renamed ASYNC_init_thread and ASYNC_free_pool is renamed ASYNC_cleanup_thread. Also introduced ASYNC_init and ASYNC_cleanup. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
s_server already had the ability to wait on an async file descriptor. This adds it to s_client too. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
s_client was not freeing up the async pool if async mode was enabled. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
A new -async option is added which activates SSL_MODE_ASYNC. Also SSL_WANT_ASYNC errors are handled appropriately. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 14 11月, 2015 1 次提交
-
-
由 Nathan Phillip Brink 提交于
Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 03 11月, 2015 1 次提交
-
-
由 Richard Levitte 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 13 10月, 2015 1 次提交
-
-
由 Matt Caswell 提交于
Loading the config file after processing command line options can cause problems, e.g. where an engine provides new ciphers/digests these are not then recoginised on the command line. Move the default config file loading to before the command line option processing. Whilst we're doing this we might as well centralise this instead of doing it individually for each application. Finally if we do it before the OpenSSL_add_ssl_algorithms() call then ciphersuites provided by an engine (e.g. GOST) can be available to the apps. RT#4085 RT#4086 Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 28 9月, 2015 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 25 9月, 2015 1 次提交
-
-
由 Matt Caswell 提交于
For those command line options that take the verification options -CApath and -CAfile, if those options are absent then the default path or file is used instead. It is not currently possible to specify *no* path or file at all. This change adds the options -no-CApath and -no-CAfile to specify that the default locations should not be used to all relevant applications. Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 11 9月, 2015 1 次提交
-
-
由 Ben Laurie 提交于
-Wincompatible-pointer-types-discards-qualifiers (the latter did not require any code changes). Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 06 9月, 2015 1 次提交
-
-
由 Richard Levitte 提交于
If the output to stdout or the input from stdin is meant to be binary, it's deeply unsetting to get the occasional LF converted to CRLF or the other way around. If someone happens to forget to redirect stdin or stdout, they will get gibberish anyway, line ending conversion will not change that. Therefore, let's not have dup_bio_* decide unilaterally what mode the BIO derived from stdin and stdout, and rather let the app decide by declaring the intended format. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 02 9月, 2015 1 次提交
-
-
由 Adam Eijdenberg 提交于
clang suggests %llu instead, but it isn't clear that is portable on all platforms. C99 and above define a handy macro for us, so we try to use that definition and fall back to current definition if needed (though we switch to 'u' for unsigned). Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 05 8月, 2015 1 次提交
-
-
由 Matt Caswell 提交于
The -use_srtp s_client/s_server option is supposed to take a colon separated string as an argument. In master this was incorrectly set to expect a filename. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 02 8月, 2015 1 次提交
-
-
由 Ben Laurie 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-