1. 19 5月, 2016 1 次提交
  2. 03 5月, 2016 1 次提交
  3. 08 4月, 2016 1 次提交
    • V
      Suppress CT callback as appropriate · 43341433
      Viktor Dukhovni 提交于
      Suppress CT callbacks with aNULL or PSK ciphersuites that involve
      no certificates.  Ditto when the certificate chain is validated via
      DANE-TA(2) or DANE-EE(3) TLSA records.  Also skip SCT processing
      when the chain is fails verification.
      
      Move and consolidate CT callbacks from libcrypto to libssl.  We
      also simplify the interface to SSL_{,CTX_}_enable_ct() which can
      specify either a permissive mode that just collects information or
      a strict mode that requires at least one valid SCT or else asks to
      abort the connection.
      
      Simplified SCT processing and options in s_client(1) which now has
      just a simple pair of "-noct" vs. "-ct" options, the latter enables
      the permissive callback so that we can complete the handshake and
      report all relevant information.  When printing SCTs, print the
      validation status if set and not valid.
      Signed-off-by: NRob Percival <robpercival@google.com>
      Reviewed-by: NEmilia Käsper <emilia@openssl.org>
      43341433
  4. 03 4月, 2016 1 次提交
    • V
      Move peer chain security checks into x509_vfy.c · fbb82a60
      Viktor Dukhovni 提交于
      A new X509_VERIFY_PARAM_set_auth_level() function sets the
      authentication security level.  For verification of SSL peers, this
      is automatically set from the SSL security level.  Otherwise, for
      now, the authentication security level remains at (effectively) 0
      by default.
      
      The new "-auth_level" verify(1) option is available in all the
      command-line tools that support the standard verify(1) options.
      
      New verify(1) tests added to check enforcement of chain signature
      and public key security levels.  Also added new tests of enforcement
      of the verify_depth limit.
      
      Updated documentation.
      Reviewed-by: NDr. Stephen Henson <steve@openssl.org>
      fbb82a60
  5. 20 3月, 2016 1 次提交
  6. 08 3月, 2016 1 次提交
  7. 04 3月, 2016 1 次提交
  8. 24 2月, 2016 1 次提交
  9. 11 2月, 2016 1 次提交
  10. 09 2月, 2016 1 次提交
    • V
      Suppress DANE TLSA reflection when verification fails · c0a445a9
      Viktor Dukhovni 提交于
      As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa()
      are expected to return a negative match depth and nothing else when
      verification fails.  However, this only happened when verification
      failed during chain construction.  Errors in verification of the
      constructed chain did not have the intended effect on these functions.
      
      This commit updates the functions to check for verify_result ==
      X509_V_OK, and no longer erases any accumulated match information
      when chain construction fails.  Sophisticated developers can, with
      care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA
      info even when verification fail.  They must of course first check
      and save the real error, and restore the original error as quickly
      as possible.  Hiding by default seems to be the safer interface.
      
      Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find
      matching TLSA records.  Previously reported via X509_V_ERR_CERT_UNTRUSTED.
      
      This also changes the "-brief" output from s_client to include
      verification results and TLSA match information.
      
      Mentioned session resumption in code example in SSL_CTX_dane_enable(3).
      Also mentioned that depths returned are relative to the verified chain
      which is now available via SSL_get0_verified_chain(3).
      
      Added a few more test-cases to danetest, that exercise the new
      code.
      
      Resolved thread safety issue in use of static buffer in
      X509_verify_cert_error_string().
      
      Fixed long-stating issue in apps/s_cb.c which always sets verify_error
      to either X509_V_OK or "chain to long", code elsewhere (e.g.
      s_time.c), seems to expect the actual error.  [ The new chain
      construction code is expected to correctly generate "chain
      too long" errors, so at some point we need to drop the
      work-arounds, once SSL_set_verify_depth() is also fixed to
      propagate the depth to X509_STORE_CTX reliably. ]
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      c0a445a9
  11. 06 2月, 2016 2 次提交
  12. 15 1月, 2016 1 次提交
  13. 08 1月, 2016 1 次提交
  14. 21 11月, 2015 1 次提交
  15. 14 11月, 2015 1 次提交
  16. 25 9月, 2015 1 次提交
  17. 22 8月, 2015 1 次提交
  18. 31 7月, 2015 1 次提交
  19. 23 5月, 2015 1 次提交
  20. 03 5月, 2015 1 次提交
  21. 25 2月, 2015 1 次提交
  22. 04 12月, 2014 1 次提交
  23. 15 10月, 2014 1 次提交
  24. 15 7月, 2014 1 次提交
  25. 07 7月, 2014 1 次提交
  26. 04 7月, 2014 1 次提交
  27. 03 7月, 2014 1 次提交
  28. 20 6月, 2014 2 次提交
  29. 07 4月, 2014 1 次提交
  30. 06 9月, 2013 3 次提交
    • S
      Add callbacks supporting generation and retrieval of supplemental data... · 36086186
      Scott Deboy 提交于
      Add callbacks supporting generation and retrieval of supplemental data entries, facilitating RFC 5878 (TLS auth extensions)
      Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API
      Tests exercising the new supplemental data registration and callback api can be found in ssltest.c.
      Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
      36086186
    • C
      Add an "-xmpphost" option to s_client · b98af49d
      Carlos Alberto Lopez Perez 提交于
       * Many XMPP servers are configured with multiple domains (virtual hosts)
       * In order to establish successfully the TLS connection you have to specify
         which virtual host you are trying to connect.
       * Test this, for example with ::
         * Fail:
             openssl s_client -connect talk.google.com:5222 -starttls xmpp
         * Works:
             openssl s_client -connect talk.google.com:5222 -starttls xmpp -xmpphost gmail.com
      b98af49d
    • C
  31. 18 6月, 2013 1 次提交
    • T
      Cleanup of custom extension stuff. · 9cd50f73
      Trevor 提交于
      serverinfo rejects non-empty extensions.
      
      Omit extension if no relevant serverinfo data.
      
      Improve error-handling in serverinfo callback.
      
      Cosmetic cleanups.
      
      s_client documentation.
      
      s_server documentation.
      
      SSL_CTX_serverinfo documentation.
      
      Cleaup -1 and NULL callback handling for custom extensions, add tests.
      
      Cleanup ssl_rsa.c serverinfo code.
      
      Whitespace cleanup.
      
      Improve comments in ssl.h for serverinfo.
      
      Whitespace.
      
      Cosmetic cleanup.
      
      Reject non-zero-len serverinfo extensions.
      
      Whitespace.
      
      Make it build.
      9cd50f73
  32. 20 11月, 2012 3 次提交
  33. 26 6月, 2009 1 次提交
  34. 15 4月, 2009 1 次提交