openssl.git
6 years agoadd missing newline
Dr. Stephen Henson [Fri, 21 Dec 2012 16:24:48 +0000 (16:24 +0000)]
add missing newline

6 years agorevert OCSP_basic_verify changes: they aren't needed now we support partial chain...
Dr. Stephen Henson [Thu, 20 Dec 2012 18:51:00 +0000 (18:51 +0000)]
revert OCSP_basic_verify changes: they aren't needed now we support partial chain verification and can pass verify options to ocsp utility

6 years agoUpdate test OCSP script "tocsp" to use shell functions and to use
Dr. Stephen Henson [Thu, 20 Dec 2012 18:48:11 +0000 (18:48 +0000)]
Update test OCSP script "tocsp" to use shell functions and to use
December 17th as check date to avoid certificate expiry errors.

6 years agogost_crypt.c: more intuitive ceiling.
Andy Polyakov [Wed, 19 Dec 2012 17:24:46 +0000 (17:24 +0000)]
gost_crypt.c: more intuitive ceiling.

6 years agocorrect CHANGES
Dr. Stephen Henson [Wed, 19 Dec 2012 14:34:39 +0000 (14:34 +0000)]
correct CHANGES

6 years agoengines/cchost/gost_crypt.c: fix typo.
Andy Polyakov [Wed, 19 Dec 2012 11:06:00 +0000 (11:06 +0000)]
engines/cchost/gost_crypt.c: fix typo.

6 years agoengines/e_capi.c: fix typo.
Andy Polyakov [Wed, 19 Dec 2012 10:54:47 +0000 (10:54 +0000)]
engines/e_capi.c: fix typo.

Submitted by: Pierre Delaage

6 years agoengine/cchost: fix bugs.
Andy Polyakov [Wed, 19 Dec 2012 10:45:13 +0000 (10:45 +0000)]
engine/cchost: fix bugs.

PR: 2821
Submitted by: Dmitry Belyavsky, Serguei Leontiev

6 years agodso/dso_win32.c: fix compiler warning.
Andy Polyakov [Tue, 18 Dec 2012 18:19:54 +0000 (18:19 +0000)]
dso/dso_win32.c: fix compiler warning.

6 years agoutil/pl/VC-32.pl fix typo.
Andy Polyakov [Tue, 18 Dec 2012 18:07:20 +0000 (18:07 +0000)]
util/pl/VC-32.pl fix typo.

6 years agoUse client version when deciding which cipher suites to disable.
Dr. Stephen Henson [Tue, 18 Dec 2012 13:25:47 +0000 (13:25 +0000)]
Use client version when deciding which cipher suites to disable.

6 years agoutil/pl/VC-32.pl: refresh, switch to ws2, add crypt32, fix typo (based on
Andy Polyakov [Tue, 18 Dec 2012 09:42:31 +0000 (09:42 +0000)]
util/pl/VC-32.pl: refresh, switch to ws2, add crypt32, fix typo (based on
suggestions from Pierre Delaage).

6 years agoVC-32.pl: fix typo.
Andy Polyakov [Sun, 16 Dec 2012 19:39:24 +0000 (19:39 +0000)]
VC-32.pl: fix typo.

Submitted by: Pierre Delaage

6 years agod1_lib.c,bss_dgram.c: eliminate dependency on _ftime.
Andy Polyakov [Sun, 16 Dec 2012 19:02:59 +0000 (19:02 +0000)]
d1_lib.c,bss_dgram.c: eliminate dependency on _ftime.

6 years agoadd -rmd option to set OCSP response signing digest
Dr. Stephen Henson [Sun, 16 Dec 2012 00:10:03 +0000 (00:10 +0000)]
add -rmd option to set OCSP response signing digest

6 years agoCheck chain is not NULL before assuming we have a validated chain.
Dr. Stephen Henson [Sat, 15 Dec 2012 02:58:00 +0000 (02:58 +0000)]
Check chain is not NULL before assuming we have a validated chain.

The modification to the OCSP helper purpose breaks normal OCSP verification.
It is no longer needed now we can trust partial chains.

6 years agoReturn success when the responder is active.
Dr. Stephen Henson [Sat, 15 Dec 2012 02:56:02 +0000 (02:56 +0000)]
Return success when the responder is active.

Don't verify our own responses.

6 years agotypo
Dr. Stephen Henson [Sat, 15 Dec 2012 00:29:12 +0000 (00:29 +0000)]
typo

6 years agoAdd support for '-' as input and output filenames in ocsp utility.
Dr. Stephen Henson [Fri, 14 Dec 2012 23:30:56 +0000 (23:30 +0000)]
Add support for '-' as input and output filenames in ocsp utility.

Recognise verification arguments.

6 years agooops, revert, committed in error
Dr. Stephen Henson [Fri, 14 Dec 2012 23:29:58 +0000 (23:29 +0000)]
oops, revert, committed in error

6 years agoapps/ocsp.c
Dr. Stephen Henson [Fri, 14 Dec 2012 23:28:19 +0000 (23:28 +0000)]
apps/ocsp.c

6 years agoDocumentation improvements by Chris Palmer (Google).
Ben Laurie [Fri, 14 Dec 2012 13:28:49 +0000 (13:28 +0000)]
Documentation improvements by Chris Palmer (Google).

6 years agofips/fipsld: improve cross-compile support.
Andy Polyakov [Thu, 13 Dec 2012 22:51:01 +0000 (22:51 +0000)]
fips/fipsld: improve cross-compile support.

6 years agoUse new partial chain flag instead of modifying input parameters.
Dr. Stephen Henson [Thu, 13 Dec 2012 18:20:47 +0000 (18:20 +0000)]
Use new partial chain flag instead of modifying input parameters.

6 years agoNew verify flag to return success if we have any certificate in the
Dr. Stephen Henson [Thu, 13 Dec 2012 18:14:46 +0000 (18:14 +0000)]
New verify flag to return success if we have any certificate in the
trusted store instead of the default which is to return an error if
we can't build the complete chain.

6 years agoDocument -pubkey.
Ben Laurie [Thu, 13 Dec 2012 16:17:55 +0000 (16:17 +0000)]
Document -pubkey.

6 years agoImprove my 64-bit debug target.
Ben Laurie [Wed, 12 Dec 2012 14:14:43 +0000 (14:14 +0000)]
Improve my 64-bit debug target.

6 years agoadd -crl_download option to s_server
Dr. Stephen Henson [Wed, 12 Dec 2012 03:35:31 +0000 (03:35 +0000)]
add -crl_download option to s_server

6 years agoadd -cert_chain option to s_client
Dr. Stephen Henson [Wed, 12 Dec 2012 00:50:26 +0000 (00:50 +0000)]
add -cert_chain option to s_client

6 years agoMake openssl verify return errors.
Ben Laurie [Tue, 11 Dec 2012 16:05:14 +0000 (16:05 +0000)]
Make openssl verify return errors.

6 years agoUpdate ignores.
Ben Laurie [Tue, 11 Dec 2012 15:52:10 +0000 (15:52 +0000)]
Update ignores.

6 years agoTabification. Remove accidental duplication.
Ben Laurie [Mon, 10 Dec 2012 16:52:17 +0000 (16:52 +0000)]
Tabification. Remove accidental duplication.

6 years agorevert SUITEB128ONLY patch, anything wanting to use P-384 can use SUITEB128 instead
Dr. Stephen Henson [Mon, 10 Dec 2012 02:02:16 +0000 (02:02 +0000)]
revert SUITEB128ONLY patch, anything wanting to use P-384 can use SUITEB128 instead

6 years agoadd -badsig option to ocsp utility too.
Dr. Stephen Henson [Sun, 9 Dec 2012 16:21:46 +0000 (16:21 +0000)]
add -badsig option to ocsp utility too.

6 years agoallow ECDSA+SHA384 signature algorithm in SUITEB128ONLY mode
Dr. Stephen Henson [Sun, 9 Dec 2012 16:03:34 +0000 (16:03 +0000)]
allow ECDSA+SHA384 signature algorithm in SUITEB128ONLY mode

6 years agosend out the raw SSL/TLS headers to the msg_callback and display them in SSL_trace
Dr. Stephen Henson [Fri, 7 Dec 2012 23:42:33 +0000 (23:42 +0000)]
send out the raw SSL/TLS headers to the msg_callback and display them in SSL_trace

6 years agoFix OCSP checking.
Ben Laurie [Fri, 7 Dec 2012 18:47:47 +0000 (18:47 +0000)]
Fix OCSP checking.

6 years agotypo
Dr. Stephen Henson [Fri, 7 Dec 2012 13:23:49 +0000 (13:23 +0000)]
typo

6 years agoreally fix automatic ;-)
Dr. Stephen Henson [Fri, 7 Dec 2012 12:41:13 +0000 (12:41 +0000)]
really fix automatic ;-)

6 years agodocumentation fixes
Dr. Stephen Henson [Thu, 6 Dec 2012 23:26:11 +0000 (23:26 +0000)]
documentation fixes

6 years agofix handling of "automatic" in file mode
Dr. Stephen Henson [Thu, 6 Dec 2012 21:53:05 +0000 (21:53 +0000)]
fix handling of "automatic" in file mode

6 years agoAdd code to download CRLs based on CRLDP extension.
Dr. Stephen Henson [Thu, 6 Dec 2012 18:43:40 +0000 (18:43 +0000)]
Add code to download CRLs based on CRLDP extension.

Just a sample, real world applications would have to be cleverer.

6 years agoremove print_ssl_cert_checks() from openssl application: it is no longer used
Dr. Stephen Henson [Thu, 6 Dec 2012 18:36:51 +0000 (18:36 +0000)]
remove print_ssl_cert_checks() from openssl application: it is no longer used

6 years agoFix two bugs which affect delta CRL handling:
Dr. Stephen Henson [Thu, 6 Dec 2012 18:24:28 +0000 (18:24 +0000)]
Fix two bugs which affect delta CRL handling:

Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.

6 years agoIntegrate host, email and IP address checks into X509_verify.
Dr. Stephen Henson [Wed, 5 Dec 2012 18:35:20 +0000 (18:35 +0000)]
Integrate host, email and IP address checks into X509_verify.

Add new verify options to set checks.

Remove previous -check* commands from s_client and s_server.

6 years agoaes-s390x.pl: fix XTS bugs in z196-specific code path.
Andy Polyakov [Wed, 5 Dec 2012 17:44:45 +0000 (17:44 +0000)]
aes-s390x.pl: fix XTS bugs in z196-specific code path.

6 years agodon't print verbose policy check messages when -quiet is selected even on error
Dr. Stephen Henson [Tue, 4 Dec 2012 23:18:44 +0000 (23:18 +0000)]
don't print verbose policy check messages when -quiet is selected even on error

6 years agoghash-sparcv9.pl: shave off one more xmulx, improve T3 performance by 7%.
Andy Polyakov [Tue, 4 Dec 2012 20:21:24 +0000 (20:21 +0000)]
ghash-sparcv9.pl: shave off one more xmulx, improve T3 performance by 7%.

6 years agoinitial support for delta CRL generations by diffing two full CRLs
Dr. Stephen Henson [Tue, 4 Dec 2012 18:35:36 +0000 (18:35 +0000)]
initial support for delta CRL generations by diffing two full CRLs

6 years agomake -subj always override config file
Dr. Stephen Henson [Tue, 4 Dec 2012 18:35:04 +0000 (18:35 +0000)]
make -subj always override config file

6 years agocheck mval for NULL too
Dr. Stephen Henson [Tue, 4 Dec 2012 17:25:34 +0000 (17:25 +0000)]
check mval for NULL too

6 years agofix leak
Dr. Stephen Henson [Mon, 3 Dec 2012 16:32:52 +0000 (16:32 +0000)]
fix leak

6 years agooops, really check brief mode only ;-)
Dr. Stephen Henson [Mon, 3 Dec 2012 03:40:57 +0000 (03:40 +0000)]
oops, really check brief mode only ;-)

6 years agodon't check errno is zero, just print out message
Dr. Stephen Henson [Mon, 3 Dec 2012 03:39:23 +0000 (03:39 +0000)]
don't check errno is zero, just print out message

6 years agoif no error code and -brief selected print out connection closed instead of read...
Dr. Stephen Henson [Mon, 3 Dec 2012 03:33:44 +0000 (03:33 +0000)]
if no error code and -brief selected print out connection closed instead of read error

6 years agoadd -badsig option to corrupt CRL signatures for testing too
Dr. Stephen Henson [Sun, 2 Dec 2012 16:48:25 +0000 (16:48 +0000)]
add -badsig option to corrupt CRL signatures for testing too

6 years agoNew option to add CRLs for s_client and s_server.
Dr. Stephen Henson [Sun, 2 Dec 2012 16:16:28 +0000 (16:16 +0000)]
New option to add CRLs for s_client and s_server.

6 years agoadd option to get a certificate or CRL from a URL
Dr. Stephen Henson [Sun, 2 Dec 2012 14:00:22 +0000 (14:00 +0000)]
add option to get a certificate or CRL from a URL

6 years agoreturn error if Suite B mode is selected and TLS 1.2 can't be used. Correct error...
Dr. Stephen Henson [Sat, 1 Dec 2012 18:33:21 +0000 (18:33 +0000)]
return error if Suite B mode is selected and TLS 1.2 can't be used. Correct error coded

6 years agocryptlib.c: fix logical error.
Andy Polyakov [Sat, 1 Dec 2012 18:24:20 +0000 (18:24 +0000)]
cryptlib.c: fix logical error.

6 years agoaesni-x86_64.pl: CTR face lift, +25% on Bulldozer.
Andy Polyakov [Sat, 1 Dec 2012 18:20:39 +0000 (18:20 +0000)]
aesni-x86_64.pl: CTR face lift, +25% on Bulldozer.

6 years agoaes-s390x.pl: harmonize software-only code path [and minor optimization].
Andy Polyakov [Sat, 1 Dec 2012 11:06:19 +0000 (11:06 +0000)]
aes-s390x.pl: harmonize software-only code path [and minor optimization].

6 years agoAdd new test option set the version in generated certificates: this
Dr. Stephen Henson [Fri, 30 Nov 2012 19:24:13 +0000 (19:24 +0000)]
Add new test option set the version in generated certificates: this
is needed to test some profiles/protocols which reject certificates
with unsupported versions.

6 years agoPR: 2803
Dr. Stephen Henson [Thu, 29 Nov 2012 19:15:14 +0000 (19:15 +0000)]
PR: 2803
Submitted by: jean-etienne.schwartz@bull.net

In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.

6 years agoadd wrapper function for certificate download
Dr. Stephen Henson [Thu, 29 Nov 2012 01:15:09 +0000 (01:15 +0000)]
add wrapper function for certificate download

6 years agoconstify
Dr. Stephen Henson [Thu, 29 Nov 2012 01:13:38 +0000 (01:13 +0000)]
constify

6 years agoGeneralise OCSP I/O functions to support dowloading of other ASN1
Dr. Stephen Henson [Wed, 28 Nov 2012 16:22:53 +0000 (16:22 +0000)]
Generalise OCSP I/O functions to support dowloading of other ASN1
structures using HTTP. Add wrapper function to handle CRL download.

6 years agoC64x+ assembly pack: improve EABI support.
Andy Polyakov [Wed, 28 Nov 2012 13:19:10 +0000 (13:19 +0000)]
C64x+ assembly pack: improve EABI support.

6 years agoUpdate support for Intel compiler: add linux-x86_64-icc and fix problems.
Andy Polyakov [Wed, 28 Nov 2012 13:05:13 +0000 (13:05 +0000)]
Update support for Intel compiler: add linux-x86_64-icc and fix problems.

6 years agoNew functions to set lookup_crls callback and to retrieve internal X509_STORE
Dr. Stephen Henson [Tue, 27 Nov 2012 23:47:48 +0000 (23:47 +0000)]
New functions to set lookup_crls callback and to retrieve internal X509_STORE
from X509_STORE_CTX.

6 years agoPrint out point format list for clients too.
Dr. Stephen Henson [Mon, 26 Nov 2012 18:39:38 +0000 (18:39 +0000)]
Print out point format list for clients too.

6 years agoUse default point formats extension for server side as well as client
Dr. Stephen Henson [Mon, 26 Nov 2012 18:38:10 +0000 (18:38 +0000)]
Use default point formats extension for server side as well as client
side, if possible.

Don't advertise compressed char2 for SuiteB as it is not supported.

6 years agochange inaccurate error message
Dr. Stephen Henson [Mon, 26 Nov 2012 15:47:32 +0000 (15:47 +0000)]
change inaccurate error message

6 years agoset auto ecdh parameter selction for Suite B
Dr. Stephen Henson [Mon, 26 Nov 2012 15:10:50 +0000 (15:10 +0000)]
set auto ecdh parameter selction for Suite B

6 years agoset cmdline flag in s_server
Dr. Stephen Henson [Mon, 26 Nov 2012 12:51:12 +0000 (12:51 +0000)]
set cmdline flag in s_server

6 years agooption to output corrupted signature in certificates for testing purposes
Dr. Stephen Henson [Sun, 25 Nov 2012 22:29:52 +0000 (22:29 +0000)]
option to output corrupted signature in certificates for testing purposes

6 years agoAES for SPARC T4: add XTS, reorder subroutines to improve TLB locality.
Andy Polyakov [Sat, 24 Nov 2012 21:55:23 +0000 (21:55 +0000)]
AES for SPARC T4: add XTS, reorder subroutines to improve TLB locality.

6 years agoadd Suite B 128 bit mode offering only combination 2
Dr. Stephen Henson [Sat, 24 Nov 2012 00:59:51 +0000 (00:59 +0000)]
add Suite B 128 bit mode offering only combination 2

6 years agoDon't display messages about verify depth in s_server if -quiet it set.
Dr. Stephen Henson [Fri, 23 Nov 2012 18:56:25 +0000 (18:56 +0000)]
Don't display messages about verify depth in s_server if -quiet it set.

Add support for separate verify and chain stores in s_client.

6 years agoAdd support for printing out and retrieving EC point formats extension.
Dr. Stephen Henson [Thu, 22 Nov 2012 15:20:53 +0000 (15:20 +0000)]
Add support for printing out and retrieving EC point formats extension.

6 years agoreject zero length point format list or supported curves extensions
Dr. Stephen Henson [Thu, 22 Nov 2012 14:15:44 +0000 (14:15 +0000)]
reject zero length point format list or supported curves extensions

6 years agosupport -quiet with -msg or -trace
Dr. Stephen Henson [Wed, 21 Nov 2012 17:11:42 +0000 (17:11 +0000)]
support -quiet with -msg or -trace

6 years agocurves can be set in both client and server
Dr. Stephen Henson [Wed, 21 Nov 2012 17:01:46 +0000 (17:01 +0000)]
curves can be set in both client and server

6 years agouse correct return values when callin cmd
Dr. Stephen Henson [Wed, 21 Nov 2012 16:59:33 +0000 (16:59 +0000)]
use correct return values when callin cmd

6 years agoonly use a default curve if not already set
Dr. Stephen Henson [Wed, 21 Nov 2012 16:47:25 +0000 (16:47 +0000)]
only use a default curve if not already set

6 years agoReorganise parameters for OPENSSL_gmtime_diff.
Dr. Stephen Henson [Wed, 21 Nov 2012 14:13:20 +0000 (14:13 +0000)]
Reorganise parameters for OPENSSL_gmtime_diff.

Make ASN1_UTCTIME_cmp_time_t more robust by using the new time functions.

6 years agoSubmitted by: Florian Weimer <fweimer@redhat.com>
Dr. Stephen Henson [Wed, 21 Nov 2012 14:10:48 +0000 (14:10 +0000)]
Submitted by: Florian Weimer <fweimer@redhat.com>
PR: 2909

Update test cases to cover internal error return values.

Remove IDNA wildcard filter.

6 years agoPR: 2908
Dr. Stephen Henson [Wed, 21 Nov 2012 14:02:40 +0000 (14:02 +0000)]
PR: 2908
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>

Fix DH double free if parameter generation fails.

6 years agofix printout of expiry days if -enddate is used in ca
Dr. Stephen Henson [Tue, 20 Nov 2012 15:22:15 +0000 (15:22 +0000)]
fix printout of expiry days if -enddate is used in ca

6 years agodon't use psec or pdays if NULL
Dr. Stephen Henson [Tue, 20 Nov 2012 15:20:40 +0000 (15:20 +0000)]
don't use psec or pdays if NULL

6 years agofirst parameter is difference in days, not years
Dr. Stephen Henson [Tue, 20 Nov 2012 15:19:53 +0000 (15:19 +0000)]
first parameter is difference in days, not years

6 years agoreorganise SSL_CONF_cmd manual page and update some links
Dr. Stephen Henson [Tue, 20 Nov 2012 01:01:33 +0000 (01:01 +0000)]
reorganise SSL_CONF_cmd manual page and update some links

6 years agofix leaks
Dr. Stephen Henson [Tue, 20 Nov 2012 00:24:52 +0000 (00:24 +0000)]
fix leaks

6 years agowith -rev close connection if client sends "CLOSE"
Dr. Stephen Henson [Mon, 19 Nov 2012 23:41:24 +0000 (23:41 +0000)]
with -rev close connection if client sends "CLOSE"

6 years agoupdate usage messages
Dr. Stephen Henson [Mon, 19 Nov 2012 23:20:40 +0000 (23:20 +0000)]
update usage messages

6 years agocorrect docs
Dr. Stephen Henson [Mon, 19 Nov 2012 20:06:44 +0000 (20:06 +0000)]
correct docs

6 years agodocument -trace and -msgfile options
Dr. Stephen Henson [Mon, 19 Nov 2012 16:37:18 +0000 (16:37 +0000)]
document -trace and -msgfile options

6 years agoupdate docs for s_server/s_client
Dr. Stephen Henson [Mon, 19 Nov 2012 16:07:53 +0000 (16:07 +0000)]
update docs for s_server/s_client

6 years agomake depend
Dr. Stephen Henson [Mon, 19 Nov 2012 15:13:33 +0000 (15:13 +0000)]
make depend

6 years agonew function ASN1_TIME_diff to calculate difference between two ASN1_TIME structures
Dr. Stephen Henson [Mon, 19 Nov 2012 15:12:07 +0000 (15:12 +0000)]
new function ASN1_TIME_diff to calculate difference between two ASN1_TIME structures