openssl.git
11 years agoUse of a 'top' var creates "shadow variable" warnings.
Geoff Thorpe [Wed, 22 Oct 2008 01:25:45 +0000 (01:25 +0000)]
Use of a 'top' var creates "shadow variable" warnings.

11 years agoReinstate obj_xref.h as it is not auto generated on all platforms.
Dr. Stephen Henson [Mon, 20 Oct 2008 15:12:48 +0000 (15:12 +0000)]
Reinstate obj_xref.h as it is not auto generated on all platforms.

11 years agoFix a shed load or warnings:
Dr. Stephen Henson [Mon, 20 Oct 2008 15:12:00 +0000 (15:12 +0000)]
Fix a shed load or warnings:

Duplicate const.
Use of ; outside function.

11 years agoAdd missing "-d" to option list of openssl version.
Lutz Jänicke [Mon, 20 Oct 2008 12:53:36 +0000 (12:53 +0000)]
Add missing "-d" to option list of openssl version.

Submitted by: Alex Chen <alex_chen@filemaker.com>

11 years agoConstification.
Ben Laurie [Sun, 19 Oct 2008 22:51:27 +0000 (22:51 +0000)]
Constification.

11 years agoFix Warning...
Dr. Stephen Henson [Sun, 19 Oct 2008 17:22:34 +0000 (17:22 +0000)]
Fix Warning...

11 years agoFix multiple ; warning.
Dr. Stephen Henson [Sat, 18 Oct 2008 15:02:59 +0000 (15:02 +0000)]
Fix multiple ; warning.

11 years agoFix warning a different way.
Ben Laurie [Sat, 18 Oct 2008 12:12:34 +0000 (12:12 +0000)]
Fix warning a different way.

11 years agoFix argument order in BN_nnmod call and implement rigorous boundary
Andy Polyakov [Thu, 16 Oct 2008 07:54:41 +0000 (07:54 +0000)]
Fix argument order in BN_nnmod call and implement rigorous boundary
condition check.

11 years agoOptimize bn_correct_top.
Andy Polyakov [Wed, 15 Oct 2008 10:48:52 +0000 (10:48 +0000)]
Optimize bn_correct_top.

11 years agoRemove redundant BN_ucmp, fix boundary condition in BN_nist_mod_224 and
Andy Polyakov [Wed, 15 Oct 2008 10:47:48 +0000 (10:47 +0000)]
Remove redundant BN_ucmp, fix boundary condition in BN_nist_mod_224 and
reimplement BN_nist_mod_521.

11 years agoSet comparison function in v3_add_canonize().
Ben Laurie [Tue, 14 Oct 2008 19:27:07 +0000 (19:27 +0000)]
Set comparison function in v3_add_canonize().

11 years agoAdd XMPP STARTTLS support.
Ben Laurie [Tue, 14 Oct 2008 19:11:26 +0000 (19:11 +0000)]
Add XMPP STARTTLS support.

11 years agoOoops... remove code accidentally commited from FIPS version.
Dr. Stephen Henson [Tue, 14 Oct 2008 15:44:14 +0000 (15:44 +0000)]
Ooops... remove code accidentally commited from FIPS version.

11 years agoAdd missing lock definitions...
Dr. Stephen Henson [Tue, 14 Oct 2008 15:24:49 +0000 (15:24 +0000)]
Add missing lock definitions...

11 years agoAdd missing lock definitions.
Dr. Stephen Henson [Tue, 14 Oct 2008 15:22:11 +0000 (15:22 +0000)]
Add missing lock definitions.

11 years agoType-safe OBJ_bsearch_ex.
Ben Laurie [Tue, 14 Oct 2008 08:10:52 +0000 (08:10 +0000)]
Type-safe OBJ_bsearch_ex.

11 years agoRemove the DTLS1_BAD_VER thing from 0.9.9-dev. It is present in 0.9.8
Lutz Jänicke [Mon, 13 Oct 2008 06:45:59 +0000 (06:45 +0000)]
Remove the DTLS1_BAD_VER thing from 0.9.9-dev. It is present in 0.9.8
but has been omitted from HEAD (0.9.9), see commit
  http://cvs.openssl.org/chngview?cn=16627
by appro.

11 years agoHalf of the commit for 0.9.8 as the bitmap handling has changed.
Lutz Jänicke [Mon, 13 Oct 2008 06:43:03 +0000 (06:43 +0000)]
Half of the commit for 0.9.8 as the bitmap handling has changed.
(Firstly... ommitted)

Secondly, it wasn't even _dropping_ the offending packets, in the
non-blocking case. It was just returning garbage instead.
PR: #1752
Submitted by: David Woodhouse <dwmw2@infradead.org>

11 years agoType-checked (and modern C compliant) OBJ_bsearch.
Ben Laurie [Sun, 12 Oct 2008 14:32:47 +0000 (14:32 +0000)]
Type-checked (and modern C compliant) OBJ_bsearch.

11 years agoAdd missing DTLS1_BAD_VER (hope I got the value right).
Ben Laurie [Sun, 12 Oct 2008 14:04:34 +0000 (14:04 +0000)]
Add missing DTLS1_BAD_VER (hope I got the value right).

11 years agoWhen the underlying BIO_write() fails to send a datagram, we leave the
Lutz Jänicke [Fri, 10 Oct 2008 10:41:35 +0000 (10:41 +0000)]
When the underlying BIO_write() fails to send a datagram, we leave the
offending record queued as 'pending'. The DTLS code doesn't expect this,
and we end up hitting an OPENSSL_assert() in do_dtls1_write().

The simple fix is just _not_ to leave it queued. In DTLS, dropping
packets is perfectly acceptable -- and even preferable. If we wanted a
service with retries and guaranteed delivery, we'd be using TCP.
PR: #1703
Submitted by: David Woodhouse <dwmw2@infradead.org>

11 years agoExperimental new date handling routines. These fix issues with X509_time_adj()
Dr. Stephen Henson [Tue, 7 Oct 2008 22:55:27 +0000 (22:55 +0000)]
Experimental new date handling routines. These fix issues with X509_time_adj()
and should avoid any OS date limitations such as the year 2038 bug.

11 years agoFix incorrect command for assember file generation on IA64
Lutz Jänicke [Mon, 6 Oct 2008 10:34:49 +0000 (10:34 +0000)]
Fix incorrect command for assember file generation on IA64

Submitted by: Amadeu A. Barbosa Jr <amadeu@tecgraf.puc-rio.br>

11 years agoFix EC_KEY_check_key.
Andy Polyakov [Tue, 23 Sep 2008 17:33:11 +0000 (17:33 +0000)]
Fix EC_KEY_check_key.

11 years agoMake sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG can't
Bodo Möller [Mon, 22 Sep 2008 21:22:47 +0000 (21:22 +0000)]
Make sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG can't
enable disabled ciphersuites.

11 years agoFrom branch OpenSSL_0_9_8-stable: Allow soft-loading engines.
Bodo Möller [Mon, 15 Sep 2008 20:41:24 +0000 (20:41 +0000)]
From branch OpenSSL_0_9_8-stable: Allow soft-loading engines.

Also, fix CHANGES (consistency with stable branch).

11 years agoAdd missing CHANGES entry.
Dr. Stephen Henson [Mon, 15 Sep 2008 20:30:58 +0000 (20:30 +0000)]
Add missing CHANGES entry.

11 years agofrom 0.9.8 branch
Bodo Möller [Mon, 15 Sep 2008 20:30:17 +0000 (20:30 +0000)]
from 0.9.8 branch

11 years agoUpdate FAQ.
Dr. Stephen Henson [Mon, 15 Sep 2008 11:27:58 +0000 (11:27 +0000)]
Update FAQ.

11 years agoFix yesterday typos in bss_dgram.c.
Andy Polyakov [Mon, 15 Sep 2008 05:43:04 +0000 (05:43 +0000)]
Fix yesterday typos in bss_dgram.c.

11 years agoFix build warnings.
Geoff Thorpe [Mon, 15 Sep 2008 04:02:37 +0000 (04:02 +0000)]
Fix build warnings.

11 years agoupdate comment
Bodo Möller [Sun, 14 Sep 2008 19:50:55 +0000 (19:50 +0000)]
update comment

11 years agoWinsock handles SO_RCVTIMEO in unique manner...
Andy Polyakov [Sun, 14 Sep 2008 19:22:52 +0000 (19:22 +0000)]
Winsock handles SO_RCVTIMEO in unique manner...
PR: 1648

11 years agooops
Bodo Möller [Sun, 14 Sep 2008 18:16:07 +0000 (18:16 +0000)]
oops

11 years agodtls1_write_bytes consumers expect amount of bytes written per call, not
Andy Polyakov [Sun, 14 Sep 2008 17:56:15 +0000 (17:56 +0000)]
dtls1_write_bytes consumers expect amount of bytes written per call, not
overall.
PR: 1604

11 years agoFix SSL state transitions.
Bodo Möller [Sun, 14 Sep 2008 14:02:07 +0000 (14:02 +0000)]
Fix SSL state transitions.

Submitted by: Nagendra Modadugu

11 years agoNote about CVS branch inconsistency.
Bodo Möller [Sun, 14 Sep 2008 13:53:18 +0000 (13:53 +0000)]
Note about CVS branch inconsistency.

11 years agoReally get rid of unsafe double-checked locking.
Bodo Möller [Sun, 14 Sep 2008 13:51:44 +0000 (13:51 +0000)]
Really get rid of unsafe double-checked locking.

Also, "CHANGES" clean-ups.

11 years agoSome precautions to avoid potential security-relevant problems.
Bodo Möller [Sun, 14 Sep 2008 13:42:34 +0000 (13:42 +0000)]
Some precautions to avoid potential security-relevant problems.

11 years agoDTLS didn't handle alerts correctly.
Andy Polyakov [Sat, 13 Sep 2008 18:24:38 +0000 (18:24 +0000)]
DTLS didn't handle alerts correctly.
PR: 1632

11 years agoAIX build updates.
Andy Polyakov [Fri, 12 Sep 2008 14:45:54 +0000 (14:45 +0000)]
AIX build updates.

11 years agoAdd SSL_FIPS flag for FIPS 140-2 approved ciphersuites and add a new
Dr. Stephen Henson [Wed, 10 Sep 2008 16:02:09 +0000 (16:02 +0000)]
Add SSL_FIPS flag for FIPS 140-2 approved ciphersuites and add a new
strength "FIPS" to represent all FIPS approved ciphersuites without NULL
encryption.

11 years agoIgnoring errors in makedepend can hide problems.
Ben Laurie [Tue, 9 Sep 2008 19:08:40 +0000 (19:08 +0000)]
Ignoring errors in makedepend can hide problems.

11 years agoFix warning.
Ben Laurie [Sun, 7 Sep 2008 13:22:34 +0000 (13:22 +0000)]
Fix warning.

11 years agoFix from stable branch.
Dr. Stephen Henson [Wed, 3 Sep 2008 22:17:11 +0000 (22:17 +0000)]
Fix from stable branch.

11 years agoDo not discard cached handshake records during resumed sessions:
Dr. Stephen Henson [Wed, 3 Sep 2008 12:36:16 +0000 (12:36 +0000)]
Do not discard cached handshake records during resumed sessions:
they are used for mac computation.

11 years agoMake no-tlsext compile.
Dr. Stephen Henson [Wed, 3 Sep 2008 12:29:57 +0000 (12:29 +0000)]
Make no-tlsext compile.

11 years agoPerl script to run and verify OpenSSL against PKITS RFC3280 compliance
Dr. Stephen Henson [Mon, 1 Sep 2008 15:53:53 +0000 (15:53 +0000)]
Perl script to run and verify OpenSSL against PKITS RFC3280 compliance
test suite.

11 years agoInitial support for delta CRLs. If "use deltas" flag is set attempt to find
Dr. Stephen Henson [Mon, 1 Sep 2008 15:15:16 +0000 (15:15 +0000)]
Initial support for delta CRLs. If "use deltas" flag is set attempt to find
a delta CRL in addition to a full CRL. Check and search delta in addition to
the base.

11 years agoAdd support for CRLs partitioned by reason code.
Dr. Stephen Henson [Fri, 29 Aug 2008 11:37:21 +0000 (11:37 +0000)]
Add support for CRLs partitioned by reason code.

Tidy CRL scoring system.

Add new CRL path validation error.

11 years agoAdd support for freshest CRL extension.
Dr. Stephen Henson [Wed, 27 Aug 2008 15:52:05 +0000 (15:52 +0000)]
Add support for freshest CRL extension.

11 years agoInitial indirect CRL support.
Dr. Stephen Henson [Wed, 20 Aug 2008 16:42:19 +0000 (16:42 +0000)]
Initial indirect CRL support.

11 years agoSupport for certificateIssuer CRL entry extension.
Dr. Stephen Henson [Mon, 18 Aug 2008 16:48:47 +0000 (16:48 +0000)]
Support for certificateIssuer CRL entry extension.

11 years agoDon't use assertions to check application-provided arguments;
Bodo Möller [Thu, 14 Aug 2008 21:37:51 +0000 (21:37 +0000)]
Don't use assertions to check application-provided arguments;
and don't unnecessarily fail on input size 0.

11 years agosanity check
Bodo Möller [Wed, 13 Aug 2008 19:45:06 +0000 (19:45 +0000)]
sanity check

PR: 1679

11 years agofix error function codes
Bodo Möller [Wed, 13 Aug 2008 19:44:15 +0000 (19:44 +0000)]
fix error function codes

11 years agoMention ERR_remove_state() deprecation, and ERR_remove_thread_state(NULL).
Bodo Möller [Wed, 13 Aug 2008 19:30:01 +0000 (19:30 +0000)]
Mention ERR_remove_state() deprecation, and ERR_remove_thread_state(NULL).

11 years agoInitial support for CRL path validation. This supports distinct certificate
Dr. Stephen Henson [Wed, 13 Aug 2008 16:00:11 +0000 (16:00 +0000)]
Initial support for CRL path validation. This supports distinct certificate
and CRL signing keys.

11 years agoInitial code to support distinct certificate and CRL signing keys where the
Dr. Stephen Henson [Tue, 12 Aug 2008 16:07:52 +0000 (16:07 +0000)]
Initial code to support distinct certificate and CRL signing keys where the
CRL issuer is not part of the main path.

Not complete yet and not compiled in because the CRL issuer certificate is
not validated.

11 years agoSupport for policy mappings extension.
Dr. Stephen Henson [Tue, 12 Aug 2008 10:32:56 +0000 (10:32 +0000)]
Support for policy mappings extension.

Delete X509_POLICY_REF code.

Fix handling of invalid policy extensions to return the correct error.

Add command line option to inhibit policy mappings.

11 years agoInitial support for name constraints certificate extension.
Dr. Stephen Henson [Fri, 8 Aug 2008 15:35:29 +0000 (15:35 +0000)]
Initial support for name constraints certificate extension.

TODO: robustness checking on name forms.

11 years agoCorrect the FAQ and the threads man page re: CRYPTO_THREADID changes.
Geoff Thorpe [Wed, 6 Aug 2008 16:41:50 +0000 (16:41 +0000)]
Correct the FAQ and the threads man page re: CRYPTO_THREADID changes.

11 years agoRemove the dual-callback scheme for numeric and pointer thread IDs,
Geoff Thorpe [Wed, 6 Aug 2008 15:54:15 +0000 (15:54 +0000)]
Remove the dual-callback scheme for numeric and pointer thread IDs,
deprecate the original (numeric-only) scheme, and replace with the
CRYPTO_THREADID object. This hides the platform-specifics and should reduce
the possibility for programming errors (where failing to explicitly check
both thread ID forms could create subtle, platform-specific bugs).

Thanks to Bodo, for invaluable review and feedback.

11 years agosha1-armv4-large cosmetics.
Andy Polyakov [Wed, 6 Aug 2008 08:58:45 +0000 (08:58 +0000)]
sha1-armv4-large cosmetics.

11 years agosha1-armv4-large.pl performance improvement. On PXA255 it gives +10% on
Andy Polyakov [Wed, 6 Aug 2008 08:47:07 +0000 (08:47 +0000)]
sha1-armv4-large.pl performance improvement. On PXA255 it gives +10% on
8KB block, +60% on 1KB, +160% on 256B...

11 years agoFix signed/unsigned warning.
Geoff Thorpe [Tue, 5 Aug 2008 17:48:02 +0000 (17:48 +0000)]
Fix signed/unsigned warning.

11 years agoCorrectly handle errors in CMS I/O code.
Dr. Stephen Henson [Tue, 5 Aug 2008 15:55:53 +0000 (15:55 +0000)]
Correctly handle errors in CMS I/O code.

11 years agoFix error codes for memory-saving patch.
Bodo Möller [Mon, 4 Aug 2008 22:10:38 +0000 (22:10 +0000)]
Fix error codes for memory-saving patch.

Also, get rid of compile-time switch OPENSSL_NO_RELEASE_BUFFERS
because it was rather pointless (the new behavior has to be explicitly
requested by setting SSL_MODE_RELEASE_BUFFERS anyway).

11 years agoAdd support for nameRelativeToCRLIssuer field in distribution point name
Dr. Stephen Henson [Mon, 4 Aug 2008 15:34:27 +0000 (15:34 +0000)]
Add support for nameRelativeToCRLIssuer field in distribution point name
fields.

11 years agoMake explicit_policy handling match expected RFC3280 behaviour.
Dr. Stephen Henson [Sat, 2 Aug 2008 11:16:35 +0000 (11:16 +0000)]
Make explicit_policy handling match expected RFC3280 behaviour.

11 years agoRefer to SSL_pending from the man page for SSL_read
Lutz Jänicke [Fri, 1 Aug 2008 15:03:20 +0000 (15:03 +0000)]
Refer to SSL_pending from the man page for SSL_read

11 years agoInitial support for alternative CRL issuing certificates.
Dr. Stephen Henson [Wed, 30 Jul 2008 15:49:12 +0000 (15:49 +0000)]
Initial support for alternative CRL issuing certificates.

Allow inibit any policy flag to be set in apps.

11 years agoPolicy validation fixes.
Dr. Stephen Henson [Wed, 30 Jul 2008 15:41:42 +0000 (15:41 +0000)]
Policy validation fixes.

Inhibit any policy count should ignore self issued certificates.
Require explicit policy is the number certificate before an explict policy
is required.

11 years agoremove a doubled entry for '-binary' in the usage message
Ralf S. Engelschall [Sun, 27 Jul 2008 15:51:35 +0000 (15:51 +0000)]
remove a doubled entry for '-binary' in the usage message

11 years agoSplit ms/uplink.pl to corresponding platform versions.
Andy Polyakov [Tue, 22 Jul 2008 08:47:35 +0000 (08:47 +0000)]
Split ms/uplink.pl to corresponding platform versions.

11 years agoperlasm update: implement dataseg directive.
Andy Polyakov [Tue, 22 Jul 2008 08:44:31 +0000 (08:44 +0000)]
perlasm update: implement dataseg directive.

11 years agox86_64-xlate.pl: implement indirect jump/calls, support for Win64 SEH.
Andy Polyakov [Tue, 22 Jul 2008 08:42:06 +0000 (08:42 +0000)]
x86_64-xlate.pl: implement indirect jump/calls, support for Win64 SEH.

11 years agoWe should check the eight bytes starting at p[-9] for rollback attack
Bodo Möller [Thu, 17 Jul 2008 22:11:53 +0000 (22:11 +0000)]
We should check the eight bytes starting at p[-9] for rollback attack
detection, or the probability for an erroneous RSA_R_SSLV3_ROLLBACK_ATTACK
will be larger than necessary.

PR: 1695

11 years agomem_dbg.c: avoid compiler warnings.
Andy Polyakov [Thu, 17 Jul 2008 13:58:21 +0000 (13:58 +0000)]
mem_dbg.c: avoid compiler warnings.
PR: 1693
Submitted by: Stefan Neis

11 years agoRemove junk argument to function_begin in sha/asm/*-586.pl.
Andy Polyakov [Thu, 17 Jul 2008 09:50:56 +0000 (09:50 +0000)]
Remove junk argument to function_begin in sha/asm/*-586.pl.
PR: 1681

11 years agox86masm.pl: harmonize functions' alignment.
Andy Polyakov [Thu, 17 Jul 2008 09:46:09 +0000 (09:46 +0000)]
x86masm.pl: harmonize functions' alignment.

11 years agoMake sure not to read beyond end of buffer
Bodo Möller [Wed, 16 Jul 2008 18:10:27 +0000 (18:10 +0000)]
Make sure not to read beyond end of buffer

11 years agox86_64cpuid.pl cosmetics: harmonize $dir treatment with other modules.
Andy Polyakov [Tue, 15 Jul 2008 19:52:20 +0000 (19:52 +0000)]
x86_64cpuid.pl cosmetics: harmonize $dir treatment with other modules.

11 years agodes-596.pl update: short-circuit reference to DES_SPtrans.
Andy Polyakov [Tue, 15 Jul 2008 13:24:16 +0000 (13:24 +0000)]
des-596.pl update: short-circuit reference to DES_SPtrans.

11 years agox86masm.pl cosmetics.
Andy Polyakov [Tue, 15 Jul 2008 13:16:42 +0000 (13:16 +0000)]
x86masm.pl cosmetics.

11 years agox86nasm.pl update: use pre-defined macros and allow for /safeseh link.
Andy Polyakov [Tue, 15 Jul 2008 12:50:44 +0000 (12:50 +0000)]
x86nasm.pl update: use pre-defined macros and allow for /safeseh link.

11 years agoReaffirm that NASM is the only supported assembler for Win32 build.
Andy Polyakov [Tue, 15 Jul 2008 12:48:53 +0000 (12:48 +0000)]
Reaffirm that NASM is the only supported assembler for Win32 build.

11 years agoZero is a valid value for any_skip and map_skip
Dr. Stephen Henson [Sun, 13 Jul 2008 22:38:18 +0000 (22:38 +0000)]
Zero is a valid value for any_skip and map_skip

11 years agoWe support inhibit any policy extension, add to table.
Dr. Stephen Henson [Sun, 13 Jul 2008 15:55:37 +0000 (15:55 +0000)]
We support inhibit any policy extension, add to table.

11 years agoX509 verification fixes.
Dr. Stephen Henson [Sun, 13 Jul 2008 14:25:36 +0000 (14:25 +0000)]
X509 verification fixes.

Ignore self issued certificates when checking path length constraints.

Duplicate OIDs in policy tree in case they are allocated.

Use anyPolicy from certificate cache and not current tree level.

11 years agoIf --prefix="C:\foo\bar" is supplied to Configure for a windows target,
Geoff Thorpe [Thu, 10 Jul 2008 20:08:47 +0000 (20:08 +0000)]
If --prefix="C:\foo\bar" is supplied to Configure for a windows target,
then the backslashes need escaping to avoid being treated as switches in
the auto-generated strings in opensslconf.h. Perl users are welcome to
suggest a less hokey way of doing this ...

11 years agoAvoid warnings with -pedantic, specifically:
Dr. Stephen Henson [Fri, 4 Jul 2008 23:12:52 +0000 (23:12 +0000)]
Avoid warnings with -pedantic, specifically:

Conversion between void * and function pointer.
Value computed not used.
Signed/unsigned argument.

11 years agoRevert my earlier CRYPTO_THREADID commit, I will commit a reworked
Geoff Thorpe [Thu, 3 Jul 2008 19:59:25 +0000 (19:59 +0000)]
Revert my earlier CRYPTO_THREADID commit, I will commit a reworked
version some time soon.

11 years agoUpdate from stable branch.
Dr. Stephen Henson [Thu, 26 Jun 2008 23:27:31 +0000 (23:27 +0000)]
Update from stable branch.

11 years agoUpdate from stable branch.
Dr. Stephen Henson [Wed, 25 Jun 2008 10:43:07 +0000 (10:43 +0000)]
Update from stable branch.

11 years agoavoid potential infinite loop in final reduction round of BN_GF2m_mod_arr()
Bodo Möller [Mon, 23 Jun 2008 20:46:24 +0000 (20:46 +0000)]
avoid potential infinite loop in final reduction round of BN_GF2m_mod_arr()

Submitted by: Huang Ying
Reviewed by: Douglas Stebila

11 years agoUpdate ordinals.
Dr. Stephen Henson [Sun, 22 Jun 2008 01:09:14 +0000 (01:09 +0000)]
Update ordinals.

11 years agoFix from stable branch.
Dr. Stephen Henson [Sat, 21 Jun 2008 23:28:55 +0000 (23:28 +0000)]
Fix from stable branch.

11 years agoUpdate from stable branch.
Dr. Stephen Henson [Wed, 18 Jun 2008 15:08:41 +0000 (15:08 +0000)]
Update from stable branch.