- 12 2月, 2016 2 次提交
-
-
由 Rich Salz 提交于
Add utility macros REF_ASSERT_NOT and REF_PRINT_COUNT This is also RT 4181 Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Toshikuni Fukaya 提交于
Updated for 1.1 by Rich Salz Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 11 2月, 2016 6 次提交
-
-
由 Viktor Dukhovni 提交于
Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rich Salz 提交于
Make OPENSSL_INIT_SETTINGS an opaque structure. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Rich Salz 提交于
Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Todd Short 提交于
Update ciphers documentation as well (based on -04 rev of ID). Signed-off-by: NKurt Roeckx <kurt@roeckx.be> Reviewed-by: NRich Salz <rsalz@openssl.org> RT: #4206, GH: #642
-
由 Matt Caswell 提交于
If init failed we'd like to set an error code to indicate that. But if init failed then when the error system tries to load its strings its going to fail again. We could get into an infinite loop. Therefore we just set a single error the first time around. After that no error is set. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Matt Caswell 提交于
The new init functions can fail if the library has already been stopped. We should be able to indicate failure with a 0 return value. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 10 2月, 2016 3 次提交
-
-
由 Rich Salz 提交于
Man, there were a lot of renamings :) Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Richard Levitte 提交于
The old building scripts get removed, they are hopelessly gone in bit rot by now. Also remove the old symbol hacks. They were needed needed to shorten some names to 31 characters, and to resolve other symbol clashes. Because we now compile with /NAMES=(AS_IS,SHORTENED), this is no longer required. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Rich Salz 提交于
Remoce DYANMIC once-init stuff. After the library is stopped, you can't restart it. Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 09 2月, 2016 7 次提交
-
-
由 Matt Caswell 提交于
Fixes for the auto-init/deinit code based on review comments Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Various Makefile.in files have changes for auto-init/de-init. Make the equivalent changes in build.info. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
This option disables automatic loading of the crypto/ssl error strings in order to keep statically linked executable file size down Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Building on the pervious commit to auto initialise and de-initialise libssl Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
This commit provides the basis and core code for an auto initialisation and deinitialisation framework for libcrypto and libssl. The intention is to remove the need (in many circumstances) to call explicit initialise and deinitialise functions. Explicit initialisation will still be an option, and if non-default initialisation is needed then it will be required. Similarly for de-initialisation (although this will be a lot easier since it will bring all de-initialisation into a single function). Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Viktor Dukhovni 提交于
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Dr. Stephen Henson 提交于
Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 08 2月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
Previous commit 7bb196a7 attempted to "fix" a problem with the way SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had SSL_shutdown() return immediately having taken no action if called mid- handshake with a return value of 1 (meaning everything was shutdown successfully). In fact the shutdown has not been successful. Commit 7bb196a7 changed that to send a close_notify anyway and then return. This seems to be causing some problems for some applications so perhaps a better (much simpler) approach is revert to the previous behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown was not successful). This also fixes a bug where SSL_shutdown always returns 0 when shutdown *very* early in the handshake (i.e. we are still using SSLv23_method). Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 07 2月, 2016 1 次提交
-
-
由 Dr. Stephen Henson 提交于
Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 06 2月, 2016 5 次提交
-
-
由 Matt Caswell 提交于
Adds a set of tests for the newly rewritten DTLSv1_listen function. The test pokes various packets at the function and then checks the return value and the data written out to ensure it is what we would have expected. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
由 Matt Caswell 提交于
The recently rewriten DTLSv1_listen code does not support fragmented ClientHello messages because fragment reassembly requires server state which is against the whole point of DTLSv1_listen. This change adds some partial support for fragmented ClientHellos. It requires that the cookie must be within the initial fragment. That way any non-initial ClientHello fragments can be dropped and fragment reassembly is not required. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
由 FdaSilvaYY 提交于
Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
由 Matt Caswell 提交于
The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Viktor Dukhovni 提交于
Reviewed-by: NEmilia Käsper <emilia@openssl.org>
-
- 05 2月, 2016 1 次提交
-
-
由 Dmitry Sobinov 提交于
Reviewed-by: NKurt Roeckx <kurt@openssl.org> Reviewed-by: NMatt Caswell <matt@openssl.org>
-
- 04 2月, 2016 3 次提交
-
-
由 Dmitry-Me 提交于
Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
由 Richard Levitte 提交于
The control commands that previously took a struct sockaddr * have been changed to take a BIO_ADDR * instead. Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
由 Emilia Kasper 提交于
CRIME protection: disable compression by default, even if OpenSSL is compiled with zlib enabled. Applications can still enable compression by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by using the SSL_CONF library to configure compression. SSL_CONF continues to work as before: SSL_CONF_cmd(ctx, "Options", "Compression") enables compression. SSL_CONF_cmd(ctx, "Options", "-Compression") disables compression (now no-op by default). The command-line switch has changed from -no_comp to -comp. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
- 01 2月, 2016 2 次提交
-
-
由 Emilia Kasper 提交于
PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: NRich Salz <rsalz@openssl.org>
-
由 Richard Levitte 提交于
Now that we have the foundation for the "unified" build scheme in place, we add build.info files. They have been generated from the Makefiles in the same directories. Things that are platform specific will appear in later commits. Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 31 1月, 2016 1 次提交
-
-
由 Rich Salz 提交于
There was an unused macro in ssl_locl.h that used an internal type, so I removed it. Move bio_st from bio.h to ossl_type.h Reviewed-by: NAndy Polyakov <appro@openssl.org>
-
- 30 1月, 2016 1 次提交
-
-
由 Rich Salz 提交于
Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 29 1月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
This extends the existing async functionality to SSL_shutdown(), i.e. SSL_shutdown() can now casuse an SSL_ERROR_WANT_ASYNC error to be returned from SSL_get_error() if async mode has been enabled. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 27 1月, 2016 1 次提交
-
-
由 Rich Salz 提交于
This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-
- 26 1月, 2016 1 次提交
-
-
由 Matt Caswell 提交于
The SSL and SSL_CTX structures are reference counted. However since libssl was made opaque there is no way for users of the library to manipulate the reference counts. This adds functions to enable that. Reviewed-by: NStephen Henson <steve@openssl.org>
-
- 25 1月, 2016 1 次提交
-
-
由 Rich Salz 提交于
This is an internal facility, never documented, not for public consumption. Move it into ssl (where it's only used for DTLS). I also made the typedef's for pqueue and pitem follow our style: they name structures, not pointers. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
- 23 1月, 2016 1 次提交
-
-
由 Alessandro Ghedini 提交于
Signed-off-by: NRich Salz <rsalz@openssl.org> Reviewed-by: NKurt Roeckx <kurt@openssl.org>
-
- 20 1月, 2016 2 次提交
-
-
由 Rich Salz 提交于
Also remove depend/local_depend. Reviewed-by: NRichard Levitte <levitte@openssl.org>
-
由 Matt Caswell 提交于
Calling SSL_shutdown while in init previously gave a "1" response, meaning everything was successfully closed down (even though it wasn't). Better is to send our close_notify, but fail when trying to receive one. The problem with doing a shutdown while in the middle of a handshake is that once our close_notify is sent we shouldn't really do anything else (including process handshake/CCS messages) until we've received a close_notify back from the peer. However the peer might send a CCS before acting on our close_notify - so we won't be able to read it because we're not acting on CCS messages! Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
-