1. 22 2月, 2016 1 次提交
  2. 20 2月, 2016 1 次提交
    • E
      TLS: reject duplicate extensions · aa474d1f
      Emilia Kasper 提交于
      Adapted from BoringSSL. Added a test.
      
      The extension parsing code is already attempting to already handle this for
      some individual extensions, but it is doing so inconsistently. Duplicate
      efforts in individual extension parsing will be cleaned up in a follow-up.
      Reviewed-by: NStephen Henson <steve@openssl.org>
      aa474d1f
  3. 19 2月, 2016 2 次提交
  4. 18 2月, 2016 2 次提交
    • D
      Finish 02f7114a · 3ba84717
      David Woodhouse 提交于
      Reviewed-by: NTim Hudson <tjh@openssl.org>
      3ba84717
    • R
      RT4310: Fix varous no-XXX builds · 1288f26f
      Rich Salz 提交于
      When OPENSSL_NO_ASYNC is set, make ASYNC_{un,}block_pause() do nothing.
      This prevents md_rand.c from failing to build. Probably better to do it
      this way than to wrap every instance in an explicit #ifdef.
      
      A bunch of new socket code got added to a new file crypto/bio/b_addr.c.
      Make it all go away if OPENSSL_NO_SOCK is defined.
      
      Allow configuration with no-ripemd, no-ts, no-ui
      We use these for the UEFI build.
      
      Also remove the 'Really???' comment from no-err and no-locking. We use
      those too.
      
      We need to drop the crypto/engine directory from the build too, and also
      set OPENSSL_NO_ENGINE
      Signed-off-by: NRich Salz <rsalz@openssl.org>
      Reviewed-by: NTim Hudson <tjh@openssl.org>
      1288f26f
  5. 17 2月, 2016 3 次提交
  6. 16 2月, 2016 2 次提交
  7. 15 2月, 2016 1 次提交
  8. 13 2月, 2016 3 次提交
  9. 12 2月, 2016 2 次提交
  10. 11 2月, 2016 8 次提交
  11. 10 2月, 2016 6 次提交
  12. 09 2月, 2016 9 次提交
    • M
      Updates for auto init/deinit review comments · 35d8fa56
      Matt Caswell 提交于
      Fixes for the auto-init/deinit code based on review comments
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      35d8fa56
    • M
      Provide a thread stop API · 71567a6f
      Matt Caswell 提交于
      Add the OPENSSL_INIT_thread_stop() function.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      71567a6f
    • M
      Auto init/de-init libssl · 7fa792d1
      Matt Caswell 提交于
      Building on the pervious commit to auto initialise and de-initialise libssl
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      7fa792d1
    • M
      Auto init/deinit libcrypto · 7b9f8f7f
      Matt Caswell 提交于
      This builds on the previous commit to auto initialise/deinitialise
      libcrypto.
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      7b9f8f7f
    • M
      Provide framework for auto initialise/deinitialise of the library · b184e3ef
      Matt Caswell 提交于
      This commit provides the basis and core code for an auto initialisation
      and deinitialisation framework for libcrypto and libssl. The intention is
      to remove the need (in many circumstances) to call explicit initialise and
      deinitialise functions. Explicit initialisation will still be an option,
      and if non-default initialisation is needed then it will be required.
      Similarly for de-initialisation (although this will be a lot easier since
      it will bring all de-initialisation into a single function).
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      b184e3ef
    • V
      Suppress DANE TLSA reflection when verification fails · c0a445a9
      Viktor Dukhovni 提交于
      As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa()
      are expected to return a negative match depth and nothing else when
      verification fails.  However, this only happened when verification
      failed during chain construction.  Errors in verification of the
      constructed chain did not have the intended effect on these functions.
      
      This commit updates the functions to check for verify_result ==
      X509_V_OK, and no longer erases any accumulated match information
      when chain construction fails.  Sophisticated developers can, with
      care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA
      info even when verification fail.  They must of course first check
      and save the real error, and restore the original error as quickly
      as possible.  Hiding by default seems to be the safer interface.
      
      Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find
      matching TLSA records.  Previously reported via X509_V_ERR_CERT_UNTRUSTED.
      
      This also changes the "-brief" output from s_client to include
      verification results and TLSA match information.
      
      Mentioned session resumption in code example in SSL_CTX_dane_enable(3).
      Also mentioned that depths returned are relative to the verified chain
      which is now available via SSL_get0_verified_chain(3).
      
      Added a few more test-cases to danetest, that exercise the new
      code.
      
      Resolved thread safety issue in use of static buffer in
      X509_verify_cert_error_string().
      
      Fixed long-stating issue in apps/s_cb.c which always sets verify_error
      to either X509_V_OK or "chain to long", code elsewhere (e.g.
      s_time.c), seems to expect the actual error.  [ The new chain
      construction code is expected to correctly generate "chain
      too long" errors, so at some point we need to drop the
      work-arounds, once SSL_set_verify_depth() is also fixed to
      propagate the depth to X509_STORE_CTX reliably. ]
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      c0a445a9
    • D
      Remove ancient compatibility defines. · 9fc65806
      Dr. Stephen Henson 提交于
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      9fc65806
    • D
      Only use compatibility macros for < 1.1 API. · 116503cd
      Dr. Stephen Henson 提交于
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      116503cd
    • D
      use new function names · 425f3300
      Dr. Stephen Henson 提交于
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      425f3300