- 08 12月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
FIPS_mode() exists in all versions of OpenSSL but always returns 0 if OpenSSL is not FIPS capable. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 04 12月, 2014 1 次提交
-
-
由 Kurt Roeckx 提交于
The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 03 12月, 2014 1 次提交
-
-
由 Matt Caswell 提交于
and instead use the value provided by the underlying BIO. Also provide some new DTLS_CTRLs so that the library user can set the mtu without needing to know this constant. These new DTLS_CTRLs provide the capability to set the link level mtu to be used (i.e. including this IP/UDP overhead). The previous DTLS_CTRLs required the library user to subtract this overhead first. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 24 10月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
SSL_set_SSL_CTX is used to change the SSL_CTX for SNI, keep the supported signature algorithms and raw cipherlist. Reviewed-by: NTim Hudson <tjh@openssl.org>
-
- 22 10月, 2014 1 次提交
-
-
由 Bodo Moeller 提交于
listed after TLS_FALLBACK_SCSV. RT: 3575 Reviewed-by: NEmilia Kasper <emilia@openssl.org>
-
- 15 10月, 2014 1 次提交
-
-
由 Bodo Moeller 提交于
Reviewed-by: NStephen Henson <steve@openssl.org>
-
- 29 8月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Use the same structure for client and server custom extensions. Add utility functions in new file t1_ext.c. Use new utility functions to handle custom server and client extensions and remove a lot of code duplication. Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 15 8月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Move custom extension structures from SSL_CTX to CERT structure. This change means the form can be revised in future without binary compatibility issues. Also since CERT is part of SSL structures so per-SSL custom extensions could be supported in future as well as per SSL_CTX. Reviewed-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 04 7月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Remove RFC5878 code. It is no longer needed for CT and has numerous bugs
-
- 13 5月, 2014 1 次提交
-
-
由 Kurt Roeckx 提交于
-
- 12 5月, 2014 1 次提交
-
-
由 Günther Noack 提交于
PR: 3317
-
- 28 3月, 2014 3 次提交
-
-
由 Dr. Stephen Henson 提交于
Security callback: selects which parameters are permitted including sensible defaults based on bits of security. The "parameters" which can be selected include: ciphersuites, curves, key sizes, certificate signature algorithms, supported signature algorithms, DH parameters, SSL/TLS version, session tickets and compression. In some cases prohibiting the use of a parameters will mean they are not advertised to the peer: for example cipher suites and ECC curves. In other cases it will abort the handshake: e.g DH parameters or the peer key size. Documentation to follow...
-
由 Dr. Stephen Henson 提交于
New function ssl_cipher_disabled. Check for disabled client ciphers using ssl_cipher_disabled. New function to return only supported ciphers. New option to ciphers utility to print only supported ciphers.
-
由 Dr. Stephen Henson 提交于
Add auto DH parameter support. This is roughly equivalent to the ECDH auto curve selection but for DH. An application can just call SSL_CTX_set_auto_dh(ctx, 1); and appropriate DH parameters will be used based on the size of the server key. Unlike ECDH there is no way a peer can indicate the range of DH parameters it supports. Some peers cannot handle DH keys larger that 1024 bits for example. In this case if you call: SSL_CTX_set_auto_dh(ctx, 2); Only 1024 bit DH parameters will be used. If the server key is 7680 bits or more in size then 8192 bit DH parameters will be used: these will be *very* slow. The old export ciphersuites aren't supported but those are very insecure anyway.
-
- 22 2月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 16 1月, 2014 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Partial fix for PR#3183.
-
- 09 1月, 2014 2 次提交
-
-
由 Daniel Kahn Gillmor 提交于
DHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEDH should probably be deprecated at some point, though.
-
由 Daniel Kahn Gillmor 提交于
ECDHE is the standard term used by the RFCs and by other TLS implementations. It's useful to have the internal variables use the standard terminology. This patch leaves a synonym SSL_kEECDH in place, though, so that older code can still be built against it, since that has been the traditional API. SSL_kEECDH should probably be deprecated at some point, though.
-
- 13 12月, 2013 1 次提交
-
-
由 Dr. Stephen Henson 提交于
New functions to retrieve internal pointers to X509_VERIFY_PARAM for SSL_CTX and SSL structures. (cherry picked from commit be0c9270690ed9c1799900643cab91de146de857)
-
- 19 11月, 2013 1 次提交
-
-
由 Dr. Stephen Henson 提交于
New functions to retrieve current certificate or private key from an SSL_CTX. Constify SSL_get_private_key().
-
- 14 11月, 2013 1 次提交
-
-
由 Piotr Sikora 提交于
PR#3106
-
- 06 9月, 2013 2 次提交
-
-
由 Ben Laurie 提交于
-
由 Scott Deboy 提交于
Add callbacks supporting generation and retrieval of supplemental data entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
-
- 18 8月, 2013 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 22 7月, 2013 1 次提交
-
-
由 Adam Langley 提交于
This change adds support for ALPN[1] in OpenSSL. ALPN is the IETF blessed version of NPN and we'll be supporting both ALPN and NPN for some time yet. [1] https://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-00 Conflicts: ssl/ssl3.h ssl/t1_lib.c
-
- 28 6月, 2013 1 次提交
-
-
由 Trevor 提交于
-
- 13 6月, 2013 1 次提交
-
-
由 Trevor 提交于
Contributed by Trevor Perrin.
-
- 19 3月, 2013 1 次提交
-
-
由 Dr. Stephen Henson 提交于
The only standard compression method is stateful and is incompatible with DTLS.
-
- 18 3月, 2013 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Use the enc_flags field to determine whether we should use explicit IV, signature algorithms or SHA256 default PRF instead of hard coding which versions support each requirement.
-
- 19 11月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 08 11月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
new feature: if ctx==NULL in SSL_CTX_ctrl perform syntax checking only for some operations (currently curves and signature algorithms)
-
- 30 9月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
a ciphersuite to position the SCSV value in different places for testing purposes.
-
- 12 9月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
client hello message. Previously this could only be retrieved on an initial connection and it was impossible to determine the cipher IDs of any uknown ciphersuites.
-
- 11 9月, 2012 2 次提交
-
-
由 Dr. Stephen Henson 提交于
change the current certificate (in s->cert->key) to the one used and then SSL_get_certificate and SSL_get_privatekey will automatically work.
-
由 Ben Laurie 提交于
right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836.
-
- 31 8月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
perform sanity checks on server certificate type as soon as it is received instead of waiting until server key exchange
-
- 29 8月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
some invalid operations for testing purposes. Currently this can be used to sign using digests the peer doesn't support, EC curves the peer doesn't support and use certificates which don't match the type associated with a ciphersuite.
-
- 15 8月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
-
- 27 7月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
by a certificate chain. Add additional tests to handle client certificates: checks for matching certificate type and issuer name comparison. Print out results of checks for each candidate chain tested in s_server/s_client.
-
- 18 7月, 2012 1 次提交
-
-
由 Dr. Stephen Henson 提交于
that are disabled for this session (as opposed to always disabled by configuration).
-