openssl.git
18 years agoFix Bleichenbacher PKCS #1 1.5 countermeasure.
Bodo Möller [Fri, 1 Jun 2001 09:41:25 +0000 (09:41 +0000)]
Fix Bleichenbacher PKCS #1 1.5 countermeasure.
(The attack against SSL 3.1 and TLS 1.0 is impractical anyway,
otherwise this would be a security relevant patch.)

18 years agoincrease DEFAULT_BUFFER_SIZE (4K instead of just 1K)
Bodo Möller [Fri, 1 Jun 2001 08:38:29 +0000 (08:38 +0000)]
increase DEFAULT_BUFFER_SIZE (4K instead of just 1K)

18 years agoDon't decrement the reference counter twice when destroying dynamic
Richard Levitte [Thu, 31 May 2001 22:25:30 +0000 (22:25 +0000)]
Don't decrement the reference counter twice when destroying dynamic
links.

18 years agoFix a memory leak in 'sk_dup' in the case a realloc() fails. Also, tidy up
Geoff Thorpe [Thu, 31 May 2001 19:01:08 +0000 (19:01 +0000)]
Fix a memory leak in 'sk_dup' in the case a realloc() fails. Also, tidy up
a bit of weird code in sk_new.

18 years agoGet rid of RAW dependency warnings.
Andy Polyakov [Wed, 30 May 2001 22:01:33 +0000 (22:01 +0000)]
Get rid of RAW dependency warnings.

Submitted by:
Reviewed by:
PR:

18 years agoExtend all the loading functions to take an engine pointer, a pass
Richard Levitte [Wed, 30 May 2001 15:29:28 +0000 (15:29 +0000)]
Extend all the loading functions to take an engine pointer, a pass
string (some engines may have certificates protected by a PIN!) and
a description to put into error messages.

Also, have our own password callback that we can send both a password
and some prompt info to.  The default password callback in EVP assumes
that the passed parameter is a password, which isn't always the right
thing, and the ENGINE code (at least the nCipher one) makes other
assumptions...

Also, in spite of having the functions to load keys, some utilities
did the loading all by themselves...  That's changed too.

18 years agoA wish was expressed.
Richard Levitte [Wed, 30 May 2001 14:59:14 +0000 (14:59 +0000)]
A wish was expressed.

18 years agoDon't forget responsible person so that its clear who is to blame.
Lutz Jänicke [Tue, 29 May 2001 13:52:21 +0000 (13:52 +0000)]
Don't forget responsible person so that its clear who is to blame.

18 years agoAssembler support for IA-64. See the source code commentary for further
Andy Polyakov [Mon, 28 May 2001 20:02:51 +0000 (20:02 +0000)]
Assembler support for IA-64. See the source code commentary for further
details (performance numbers and accompanying discussions:-). Note that
the code is not engaged in ./Configure yet. I'll add it later this week
along with updates for .spec file.

Submitted by:
Reviewed by:
PR:

18 years agoDocument the latest change in ENGINEs.
Richard Levitte [Sat, 26 May 2001 16:58:34 +0000 (16:58 +0000)]
Document the latest change in ENGINEs.

18 years agoWe had the password callback for ENGINEs pretty much wrong. And
Richard Levitte [Fri, 25 May 2001 21:08:56 +0000 (21:08 +0000)]
We had the password callback for ENGINEs pretty much wrong.  And
passwords that were given to the key loading functions were completely
ignored, at least in the ncipher code, and then we made the assumption
that the callback wanted a prompt as user argument.

All that is now changed, and the application author is forced to give
a callback function of type pem_callback_cb and possibly an argument
for it, just as for all other functions that want to generate password
prompting.

NOTE: this change creates binary and source incompatibilities with
previous versions of OpenSSL [engine].  It's worth it this time, to
get it right (or at least better and with a chance that it'll work).

18 years agoAdd missing variable length cipher flag for Blowfish.
Dr. Stephen Henson [Thu, 24 May 2001 22:58:35 +0000 (22:58 +0000)]
Add missing variable length cipher flag for Blowfish.

Only use trust settings if either trust or reject settings
are present, otherwise use compatibility mode. This stops
root CAs being rejected if they have alias of keyid set.

18 years agoVMS doesn't support more than on period in a file name
Richard Levitte [Tue, 22 May 2001 12:47:38 +0000 (12:47 +0000)]
VMS doesn't support more than on period in a file name

18 years agoAdd examples to EVP_EncryptInit manual page.
Dr. Stephen Henson [Thu, 17 May 2001 13:03:20 +0000 (13:03 +0000)]
Add examples to EVP_EncryptInit manual page.

18 years agoFix for new UI functions under Win32.
Dr. Stephen Henson [Thu, 17 May 2001 11:47:08 +0000 (11:47 +0000)]
Fix for new UI functions under Win32.

For some unknown reason fopen("con", "w") is the
only way to make this work. Using "r+" and "w+"
causes the fopen call to fail and the fallback
(using stdin) doesn't work because writing to stdin
fails.

18 years agoAdd a requirements section for OpenVMS.
Richard Levitte [Thu, 17 May 2001 04:21:00 +0000 (04:21 +0000)]
Add a requirements section for OpenVMS.

18 years agoAdd a few more details on what one might need. make and a development
Richard Levitte [Thu, 17 May 2001 04:16:19 +0000 (04:16 +0000)]
Add a few more details on what one might need.  make and a development
environment were a part of a Unix operating systems, but these days
you see an increasing number of installations that do not necessarely
have these crucial parts by default, so it's needs mentioning.

18 years agoAdd missing item(s) SSL_ERROR_WANT_CONNECT, SSL_ERROR_WANT_ACCEPT.
Lutz Jänicke [Wed, 16 May 2001 09:43:51 +0000 (09:43 +0000)]
Add missing item(s) SSL_ERROR_WANT_CONNECT, SSL_ERROR_WANT_ACCEPT.

18 years agoNew internal function OPENSSL_gmtime, which is intended to do the same
Richard Levitte [Wed, 16 May 2001 08:44:09 +0000 (08:44 +0000)]
New internal function OPENSSL_gmtime, which is intended to do the same
as gmtime_r() on the systems where that is defined.

18 years agoIncrease ENTROPY_NEEDED to support Rijndael's larger key size.
Lutz Jänicke [Tue, 15 May 2001 16:02:35 +0000 (16:02 +0000)]
Increase ENTROPY_NEEDED to support Rijndael's larger key size.

18 years agoDo not forget to increment the pointers...
Richard Levitte [Tue, 15 May 2001 15:49:54 +0000 (15:49 +0000)]
Do not forget to increment the pointers...

18 years agoLow-case the names of the system routines, since some versions of
Richard Levitte [Tue, 15 May 2001 05:15:47 +0000 (05:15 +0000)]
Low-case the names of the system routines, since some versions of
DEC C only have them declared that way (it doesn't really matter,
since the linker is case-insensitive by default)

18 years agobranch on equal is beql, not beq...
Richard Levitte [Mon, 14 May 2001 22:10:09 +0000 (22:10 +0000)]
branch on equal is beql, not beq...

18 years agoMake sure strdup() is properly declared.
Richard Levitte [Mon, 14 May 2001 12:23:28 +0000 (12:23 +0000)]
Make sure strdup() is properly declared.

18 years agoMake sure memset() is properly declared.
Richard Levitte [Mon, 14 May 2001 12:22:58 +0000 (12:22 +0000)]
Make sure memset() is properly declared.

18 years agoui was forgotten when installing libcrypto and it's headers.
Richard Levitte [Mon, 14 May 2001 12:22:27 +0000 (12:22 +0000)]
ui was forgotten when installing libcrypto and it's headers.

18 years agoui_compat.h was forgotten in the "symlinking" routine.
Richard Levitte [Mon, 14 May 2001 12:21:16 +0000 (12:21 +0000)]
ui_compat.h was forgotten in the "symlinking" routine.

18 years agoRemove the password reading objects from LIB_DES.
Richard Levitte [Mon, 14 May 2001 11:59:02 +0000 (11:59 +0000)]
Remove the password reading objects from LIB_DES.

18 years agoMake more short aliases for symbols that are longer than 31
Richard Levitte [Mon, 14 May 2001 11:58:08 +0000 (11:58 +0000)]
Make more short aliases for symbols that are longer than 31
characters.

18 years agolen is a size_t, which is an unsigned integer. Therefore, some
Richard Levitte [Mon, 14 May 2001 11:56:47 +0000 (11:56 +0000)]
len is a size_t, which is an unsigned integer.  Therefore, some
compilers will complain against the check for less than zero.

18 years agoUse ui_compat.h to get the password reading functions.
Richard Levitte [Mon, 14 May 2001 11:54:36 +0000 (11:54 +0000)]
Use ui_compat.h to get the password reading functions.

18 years agoMake it so the compiler doesn't inform me about the dollars in some
Richard Levitte [Mon, 14 May 2001 11:53:37 +0000 (11:53 +0000)]
Make it so the compiler doesn't inform me about the dollars in some
symbols.

18 years agoTypos.
Lutz Jänicke [Mon, 14 May 2001 09:52:44 +0000 (09:52 +0000)]
Typos.

18 years agoOne more point to clarify, pointed out by "Greg Stark" <ghstark@pobox.com>
Lutz Jänicke [Mon, 14 May 2001 09:02:38 +0000 (09:02 +0000)]
One more point to clarify, pointed out by "Greg Stark" <ghstark@pobox.com>

18 years agoIt seems like the removal of "extern" before "static" wasn't a
Richard Levitte [Sun, 13 May 2001 17:55:30 +0000 (17:55 +0000)]
It seems like the removal of "extern" before "static" wasn't a
mistake.

18 years agoDocument the addition.
Richard Levitte [Sun, 13 May 2001 10:37:02 +0000 (10:37 +0000)]
Document the addition.

18 years agoA randomizer for OpenVMS, using the statistics that are easily
Richard Levitte [Sun, 13 May 2001 10:34:18 +0000 (10:34 +0000)]
A randomizer for OpenVMS, using the statistics that are easily
reachable.

It's completely untested for now.  To be done in the next few days.

18 years agoDefine `ok' and better error detection.
Richard Levitte [Sun, 13 May 2001 05:34:39 +0000 (05:34 +0000)]
Define `ok' and better error detection.

18 years agomake update
Richard Levitte [Sun, 13 May 2001 05:16:58 +0000 (05:16 +0000)]
make update

18 years agoWin16 too :-).
Richard Levitte [Sun, 13 May 2001 05:01:58 +0000 (05:01 +0000)]
Win16 too :-).

18 years agodes_read_password() and des_read_2passwords() can only appear if DES
Richard Levitte [Sun, 13 May 2001 04:59:09 +0000 (04:59 +0000)]
des_read_password() and des_read_2passwords() can only appear if DES
is compiled.

18 years agoWhen doing rewrites on ssleay.num, the file was prematurely closed.
Richard Levitte [Sun, 13 May 2001 04:48:07 +0000 (04:48 +0000)]
When doing rewrites on ssleay.num, the file was prematurely closed.
Make rewrites the default, since it works, and people get confused if
changed information doesn't get rewritten automagically.

18 years agoMove the password reading functions completely away from the DES
Richard Levitte [Sun, 13 May 2001 04:40:44 +0000 (04:40 +0000)]
Move the password reading functions completely away from the DES
section.

Add ui_compat.h for inclusion by those who want the old functions and
provide all of them, not just the higher-level ones, in ui_compat.c.

18 years agoPut back a removed "extern", or many compilers will complain about
Richard Levitte [Sun, 13 May 2001 04:34:57 +0000 (04:34 +0000)]
Put back a removed "extern", or many compilers will complain about
redefined variables.

18 years ago#if 0 out deleted (?) functions to stop Win32 DLL
Dr. Stephen Henson [Sun, 13 May 2001 00:33:55 +0000 (00:33 +0000)]
#if 0 out deleted (?) functions to stop Win32 DLL
build falling over.

18 years agoChange Win32 to use EXPORT_VAR_AS_FN.
Dr. Stephen Henson [Sat, 12 May 2001 23:57:41 +0000 (23:57 +0000)]
Change Win32 to use EXPORT_VAR_AS_FN.

Fix OPENSSL_IMPLEMENT_GLOBAL.

Allow Win32 to use EXPORT_VAR_AS_FN in mkdef.pl

make update.

18 years agoClarify behaviour with respect to SSL/TLS records.
Lutz Jänicke [Sat, 12 May 2001 09:49:02 +0000 (09:49 +0000)]
Clarify behaviour with respect to SSL/TLS records.

18 years agoUnder VC++ _DLL is set to indicate that the application
Dr. Stephen Henson [Sat, 12 May 2001 00:16:56 +0000 (00:16 +0000)]
Under VC++ _DLL is set to indicate that the application
will be linked against the DLL runtime library. It is
automatically set when /MD is used.

As a result OpenSSL shouldn't use _DLL to determine if
it should set OPENSSL_OPT_WINDLL because this will
cause linkage conflicts with static builds which do
include the /MD compiler switch.

18 years agoTypo.
Dr. Stephen Henson [Sat, 12 May 2001 00:09:04 +0000 (00:09 +0000)]
Typo.

18 years agoe_os2.h defines things like OPENSSL_SYS_MSDOS, not opensslconf.h...
Richard Levitte [Fri, 11 May 2001 11:20:26 +0000 (11:20 +0000)]
e_os2.h defines things like OPENSSL_SYS_MSDOS, not opensslconf.h...
(basically: whooops :-))

18 years agoClarify behaviour of SSL_write() by mentioning SSL_MODE_ENABLE_PARTIAL_WRITE
Lutz Jänicke [Fri, 11 May 2001 09:53:10 +0000 (09:53 +0000)]
Clarify behaviour of SSL_write() by mentioning SSL_MODE_ENABLE_PARTIAL_WRITE
flag as discussed on the mailing list.

18 years agoUpdate changelog to reflect additional changes made to the egd-locations.
Lutz Jänicke [Thu, 10 May 2001 09:45:31 +0000 (09:45 +0000)]
Update changelog to reflect additional changes made to the egd-locations.

18 years agorestore change undone in 1.831 (apparently by accident)
Bodo Möller [Thu, 10 May 2001 09:33:18 +0000 (09:33 +0000)]
restore change undone in 1.831 (apparently by accident)

18 years agoPurpose and trust setting functions for X509_STORE.
Dr. Stephen Henson [Thu, 10 May 2001 00:13:59 +0000 (00:13 +0000)]
Purpose and trust setting functions for X509_STORE.

Tidy existing code.

18 years agoFix warning with DEBUG_SAFESTACK
Dr. Stephen Henson [Thu, 10 May 2001 00:09:43 +0000 (00:09 +0000)]
Fix warning with DEBUG_SAFESTACK

18 years agoFix to allow multiple NONE libraries in mkerr.pl .
Dr. Stephen Henson [Thu, 10 May 2001 00:07:45 +0000 (00:07 +0000)]
Fix to allow multiple NONE libraries in mkerr.pl .

18 years agoAllow various X509_STORE_CTX properties to be
Dr. Stephen Henson [Wed, 9 May 2001 00:30:39 +0000 (00:30 +0000)]
Allow various X509_STORE_CTX properties to be
inherited from X509_STORE.

Add CRL checking options to other applications.

18 years agofix an old entry
Bodo Möller [Tue, 8 May 2001 12:45:55 +0000 (12:45 +0000)]
fix an old entry

18 years agoThere is no uitest
Richard Levitte [Tue, 8 May 2001 04:23:25 +0000 (04:23 +0000)]
There is no uitest

18 years agoDon't forget crypto/ui...
Richard Levitte [Tue, 8 May 2001 04:09:19 +0000 (04:09 +0000)]
Don't forget crypto/ui...

18 years agoInitial CRL based revocation checking.
Dr. Stephen Henson [Mon, 7 May 2001 22:52:50 +0000 (22:52 +0000)]
Initial CRL based revocation checking.

18 years agoClarify the license and copyright, make preprocessor dirctives a
Richard Levitte [Mon, 7 May 2001 06:33:35 +0000 (06:33 +0000)]
Clarify the license and copyright, make preprocessor dirctives a
little bit clearer and use the new OPENSSL_SYS_* macros.

18 years agomake update
Richard Levitte [Sun, 6 May 2001 23:51:37 +0000 (23:51 +0000)]
make update

18 years agoAdd a general user interface API. This is designed to replace things
Richard Levitte [Sun, 6 May 2001 23:19:37 +0000 (23:19 +0000)]
Add a general user interface API.  This is designed to replace things
like des_read_password and friends (backward compatibility functions
using this new API are provided).  The purpose is to remove prompting
functions from the DES code section as well as provide for prompting
through dialog boxes in a window system and the like.

18 years agothe backslash is significant...
Ulf Möller [Fri, 4 May 2001 15:03:59 +0000 (15:03 +0000)]
the backslash is significant...

18 years ago.rnd issues
Bodo Möller [Thu, 3 May 2001 09:27:43 +0000 (09:27 +0000)]
.rnd issues

18 years agobctest changes for Ultrix (don't return 1 from bctest, otherwise make aborts)
Bodo Möller [Thu, 3 May 2001 08:50:27 +0000 (08:50 +0000)]
bctest changes for Ultrix (don't return 1 from bctest, otherwise make aborts)

18 years agoSome platforms (most notably Windows) do not have a $HOME by default.
Richard Levitte [Thu, 3 May 2001 07:50:11 +0000 (07:50 +0000)]
Some platforms (most notably Windows) do not have a $HOME by default.
For those, unless the environment variables RANDFILE or HOME are
defined (the default case!), RAND_file_name() will return NULL.
This change adds a default HOME for those platforms.

To add a default HOME for any platform, just define DEFAULT_HOME in
the proper place, wrapped in appropriate #ifdef..#endif, in e_os.h.

18 years agoAdd support for Sun C on Solaris x86. Contributed by Ben <mouring@etoh.eviladmin...
Richard Levitte [Thu, 3 May 2001 06:14:47 +0000 (06:14 +0000)]
Add support for Sun C on Solaris x86.  Contributed by Ben <mouring@etoh.eviladmin.org>

18 years agoRemove part conflict indicator...
Richard Levitte [Wed, 2 May 2001 07:15:03 +0000 (07:15 +0000)]
Remove part conflict indicator...

18 years agoIn RSA, DSA, DH, and RAND - if the "***_new()" function fails because the
Geoff Thorpe [Mon, 30 Apr 2001 15:24:41 +0000 (15:24 +0000)]
In RSA, DSA, DH, and RAND - if the "***_new()" function fails because the
ENGINE code does not return a default, set an error.

18 years agoWin32 fixes:
Dr. Stephen Henson [Sun, 29 Apr 2001 16:30:59 +0000 (16:30 +0000)]
Win32 fixes:

define LLONG properly for VC++.

stop compiler complaining about signed/unsigned mismatch in apps/engine.c

18 years agoA method to create shared libraries on AIX, and according to
Richard Levitte [Fri, 27 Apr 2001 21:33:44 +0000 (21:33 +0000)]
A method to create shared libraries on AIX, and according to
"Howard Chu" <hyc@highlandsun.com>, it may be general enough
to work on any Unixly system.

18 years agomake update
Richard Levitte [Fri, 27 Apr 2001 08:59:00 +0000 (08:59 +0000)]
make update

18 years agoFor some inexplicable reason, I'd (a) left the debugging irreversibly
Geoff Thorpe [Fri, 27 Apr 2001 00:31:21 +0000 (00:31 +0000)]
For some inexplicable reason, I'd (a) left the debugging irreversibly
turned on, and (b) left a somewhat curious debugging string in the output.

18 years agoSome fixes to the reference-counting in ENGINE code. First, there were a
Geoff Thorpe [Thu, 26 Apr 2001 23:04:30 +0000 (23:04 +0000)]
Some fixes to the reference-counting in ENGINE code. First, there were a
few statements equivalent to "ENGINE_add(ENGINE_openssl())" etc. The inner
call to ENGINE_openssl() (as with other functions like it) orphans a
structural reference count. Second, the ENGINE_cleanup() function also
needs to clean up the functional reference counts held internally as the
list of "defaults" (ie. as used when RSA_new() requires an appropriate
ENGINE reference). So ENGINE_clear_defaults() was created and is called
from within ENGINE_cleanup(). Third, some of the existing code was
logically broken in its treatment of reference counts and locking (my
fault), so the necessary bits have been restructured and tidied up.

To test this stuff, compiling with ENGINE_REF_COUNT_DEBUG will cause every
reference count change (both structural and functional) to log a message to
'stderr'. Using with "openssl engine" for example shows this in action
quite well as the 'engine' sub-command cleans up after itself properly.

Also replaced some spaces with tabs.

18 years agoMake proper use of all disabling variables.
Richard Levitte [Thu, 26 Apr 2001 21:02:57 +0000 (21:02 +0000)]
Make proper use of all disabling variables.

18 years ago"make update"
Geoff Thorpe [Thu, 26 Apr 2001 20:56:30 +0000 (20:56 +0000)]
"make update"

18 years agoMake notes about ENGINE changes.
Geoff Thorpe [Thu, 26 Apr 2001 20:42:12 +0000 (20:42 +0000)]
Make notes about ENGINE changes.

18 years agoLinux shared libraries can be linked with debug symbols.
Richard Levitte [Thu, 26 Apr 2001 20:17:59 +0000 (20:17 +0000)]
Linux shared libraries can be linked with debug symbols.
Tru64 shared libraries can be linked with static libraries.

18 years agomake update
Richard Levitte [Thu, 26 Apr 2001 19:45:31 +0000 (19:45 +0000)]
make update

18 years agoThis adds 2 things to the ENGINE code.
Geoff Thorpe [Thu, 26 Apr 2001 19:35:44 +0000 (19:35 +0000)]
This adds 2 things to the ENGINE code.

 * "ex_data" - a CRYPTO_EX_DATA structure in the ENGINE structure itself
   that allows an ENGINE to store its own information there rather than in
   global variables. It follows the declarations and implementations used
   in RSA code, for better or worse. However there's a problem when storing
   state with ENGINEs because, unlike related structure types in OpenSSL,
   there is no ENGINE-vs-ENGINE_METHOD separation. Because of what ENGINE
   is, it has method pointers as its structure elements ...  which leads
   to;

 * ENGINE_FLAGS_BY_ID_COPY - if an ENGINE should not be used just as a
   reference to an "implementation" (eg. to get to a hardware device), but
   should also be able to maintain state, then this flag can be set by the
   ENGINE implementation. The result is that any call to ENGINE_by_id()
   will not result in the existing ENGINE being returned (with its
   structural reference count incremented) but instead a new copy of the
   ENGINE will be returned that can maintain its own state independantly of
   any other copies returned in the past or future. Eg. key-generation
   might involve a series of ENGINE-specific control commands to set
   algorithms, sizes, module-keys, ids, ACLs, etc. A final command could
   generate the key. An ENGINE doing this would *have* to declare
   ENGINE_FLAGS_BY_ID_COPY so that the state of that process can be
   maintained "per-handle" and unaffected by other code having a reference
   to the same ENGINE structure.

18 years agoClean up ENGINE before exiting.
Richard Levitte [Thu, 26 Apr 2001 16:08:10 +0000 (16:08 +0000)]
Clean up ENGINE before exiting.

18 years agoProvide the possibility to clean up internal ENGINE structures. This
Richard Levitte [Thu, 26 Apr 2001 16:07:08 +0000 (16:07 +0000)]
Provide the possibility to clean up internal ENGINE structures.  This
takes care of what would otherwise be seen as a memory leak.

18 years agogcc warns when certain values of an enumeration aren't taken care of,
Richard Levitte [Thu, 26 Apr 2001 15:53:42 +0000 (15:53 +0000)]
gcc warns when certain values of an enumeration aren't taken care of,
unless there's a default clause.

18 years agoCheck for OPENSSL_NO_RSA, OPENSSL_NO_DSA and OPENSSL_NO_DH and disable
Richard Levitte [Thu, 26 Apr 2001 15:45:12 +0000 (15:45 +0000)]
Check for OPENSSL_NO_RSA, OPENSSL_NO_DSA and OPENSSL_NO_DH and disable
appropriate code if any of them is defined.

18 years agoengine.h includes all the needed header files, so don't do it again
Richard Levitte [Thu, 26 Apr 2001 15:04:22 +0000 (15:04 +0000)]
engine.h includes all the needed header files, so don't do it again
here.

18 years agoWe shouldn't skip over header files to avoid functions of disabled algorithms. The...
Richard Levitte [Thu, 26 Apr 2001 12:01:12 +0000 (12:01 +0000)]
We shouldn't skip over header files to avoid functions of disabled algorithms.  The selection is done in a different way

18 years agoUser OPENSSL_UNISTD instead of <unistd.h>.
Richard Levitte [Thu, 26 Apr 2001 08:26:18 +0000 (08:26 +0000)]
User OPENSSL_UNISTD instead of <unistd.h>.
Spotted by Mark Crispin <MRC@Panda.COM>

18 years agoThis change to the "dl", "dlfcn", and "win32" DSO_METHODs adds the filename
Geoff Thorpe [Wed, 25 Apr 2001 22:40:55 +0000 (22:40 +0000)]
This change to the "dl", "dlfcn", and "win32" DSO_METHODs adds the filename
or symbol name to the error stack in the event a load or bind operation
failed.

18 years agoTypo (reported by Petr Lancaric <Petr.Lancaric@ips-ag.cz>)
Lutz Jänicke [Wed, 25 Apr 2001 15:24:47 +0000 (15:24 +0000)]
Typo (reported by Petr Lancaric <Petr.Lancaric@ips-ag.cz>)

18 years agoMake update.
Geoff Thorpe [Sun, 22 Apr 2001 17:21:19 +0000 (17:21 +0000)]
Make update.

18 years agoFix ASN1 bug when decoding OTHER type.
Dr. Stephen Henson [Sat, 21 Apr 2001 12:06:01 +0000 (12:06 +0000)]
Fix ASN1 bug when decoding OTHER type.

Various S/MIME DSA related fixes.

18 years agoScript to create shareable images (shared libraries in Unixly terms)
Richard Levitte [Fri, 20 Apr 2001 13:09:10 +0000 (13:09 +0000)]
Script to create shareable images (shared libraries in Unixly terms)
on VMS.

18 years agoVMS was behind when it comes to OCSP.
Richard Levitte [Fri, 20 Apr 2001 12:37:14 +0000 (12:37 +0000)]
VMS was behind when it comes to OCSP.

18 years agoAdd notes about the new ENGINE functionality.
Geoff Thorpe [Thu, 19 Apr 2001 23:06:00 +0000 (23:06 +0000)]
Add notes about the new ENGINE functionality.

18 years agoChanges to "openssl engine" to support the new control command code in
Geoff Thorpe [Thu, 19 Apr 2001 02:08:26 +0000 (02:08 +0000)]
Changes to "openssl engine" to support the new control command code in
ENGINE.

 * Extra verbosity can be added with more "v"'s, eg. '-vvv' gives
   information about input flags and descriptions for each control command
   in each ENGINE. Check the output of "openssl engine -vvv" for example.

 * '-pre <cmd>' and '-post <cmd>' can be used to invoke control commands on
   the specified ENGINE (or on all of them if no engine id is specified,
   although that usually gets pretty ugly). '-post' commands are only
   attempted if '-t' is specified and the engine successfully initialises.
   '-pre' commands are always attempted whether or not '-t' causes an
   initialisation to be tried afterwards. Multiple '-pre' and/or '-post'
   commands can be specified and they will be called in the order they
   occur on the command line.

Parameterised commands (the normal case, there are currently no
unparameterised ones) are split into command and argument via a separating
colon. Eg. "openssl engine -pre SO_PATH:/lib/libdriver.so <id>" results in
the call;
    ENGINE_ctrl_cmd_string(e, "SO_PATH", "/lib/libdriver.so", 0);

Application code should similarly allow arbitrary name-value string pairs
to be passed into ENGINEs in a manner matching that in apps/engine.c,
either using the same colon-separated format, or entered as two distinct
strings. Eg. as stored in a registry. The last parameter of
ENGINE_ctrl_cmd_string can be changed from 0 to 1 if the command should
only be attempted if it's supported by the specified ENGINE (eg. for
commands like "FORK_CHECK:1" that may or may not apply to the run-time
ENGINE).

18 years agoSome more tweaks to ENGINE code.
Geoff Thorpe [Thu, 19 Apr 2001 01:45:40 +0000 (01:45 +0000)]
Some more tweaks to ENGINE code.

This change adds some basic control commands to the existing ENGINEs
(except the software 'openssl' engine). All these engines currently load
shared-libraries for hardware APIs, so they've all been given "SO_PATH"
commands that will configure the chosen ENGINE to load its shared library
from the given path. Eg. by calling;
    ENGINE_ctrl_cmd_string(e, "SO_PATH", <path>, 0).

The nCipher 'chil' ENGINE has also had "FORK_CHECK" and "THREAD_LOCKING"
commands added so these settings could be handled via application-level
configuration rather than in application source code.

Changes to "openssl engine" to test and examine these control commands will
be made shortly. It will also provide the necessary tips to application
programs wanting to support these dynamic control commands.

18 years agoSome BIG tweaks to ENGINE code.
Geoff Thorpe [Thu, 19 Apr 2001 00:41:55 +0000 (00:41 +0000)]
Some BIG tweaks to ENGINE code.

This change adds some new functionality to the ENGINE code and API to
make it possible for ENGINEs to describe and implement their own control
commands that can be interrogated and used by calling applications at
run-time. The source code includes numerous comments explaining how it all
works and some of the finer details. But basically, an ENGINE will normally
declare an array of ENGINE_CMD_DEFN entries in its ENGINE - and the various
new ENGINE_CTRL_*** command types take care of iterating through this list
of definitions, converting command numbers to names, command names to
numbers, getting descriptions, getting input flags, etc. These
administrative commands are handled directly in the base ENGINE code rather
than in each ENGINE's ctrl() handler, unless they specify the
ENGINE_FLAGS_MANUAL_CMD_CTRL flag (ie. if they're doing something clever or
dynamic with the command definitions).

There is also a new function, ENGINE_cmd_is_executable(), that will
determine if an ENGINE control command is of an "executable" type that
can be used in another new function, ENGINE_ctrl_cmd_string(). If not, the
control command is not supposed to be exposed out to user/config level
access - eg. it could involve the exchange of binary data, returning
results to calling code, etc etc. If the command is executable then
ENGINE_ctrl_cmd_string() can be called using a name/arg string pair. The
control command's input flags will be used to determine necessary
conversions before the control command is called, and commands of this
form will always return zero or one (failure or success, respectively).
This is set up so that arbitrary applications can support control commands
in a consistent way so that tweaking particular ENGINE behaviour is
specific to the ENGINE and the host environment, and independant of the
application or OpenSSL.

Some code demonstrating this stuff in action will applied shortly to the
various ENGINE implementations, as well as "openssl engine" support for
executing arbitrary control commands before and/or after initialising
various ENGINEs.

18 years agoSome more tweaks to ENGINE code.
Geoff Thorpe [Wed, 18 Apr 2001 21:46:00 +0000 (21:46 +0000)]
Some more tweaks to ENGINE code.

The existing ENGINEs (including the default 'openssl' software engine) were
static, declared inside the source file for each engine implementation. The
reason this was not going boom was that all the ENGINEs had reference
counts that never hit zero (once linked into the internal list, each would
always have at least 1 lasting structural reference).

To fix this so it will stay standing when an "unload" function is added to
match ENGINE_load_builtin_engines(), the "constructor" functions for each
ENGINE implementation have been changed to dynamically allocate and
construct their own ENGINEs using API functions. The other benefit of this
is that no ENGINE implementation has to include the internal "engine_int.h"
header file any more.