openssl.git
18 years agoRename recently introduced functions for improved code clarity:
Bodo Möller [Mon, 3 Sep 2001 13:40:07 +0000 (13:40 +0000)]
Rename recently introduced functions for improved code clarity:
      [DR]SA_up  =>  [DR]SA_up_ref

18 years agoUse uniformly chosen witnesses for Miller-Rabin test
Bodo Möller [Mon, 3 Sep 2001 12:58:16 +0000 (12:58 +0000)]
Use uniformly chosen witnesses for Miller-Rabin test
(by using new BN_pseudo_rand_range function)

18 years agorearrange #includes because trying to include <crypto/cryptodev.h>
Bodo Möller [Mon, 3 Sep 2001 12:37:13 +0000 (12:37 +0000)]
rearrange #includes because trying to include <crypto/cryptodev.h>
is a bad idea if OPENSSL_OPENBSD_DEV_CRYPTO is not defined

18 years agoConvert "max" to "mx" for variable names (brought to my attention by Steve
Geoff Thorpe [Sun, 2 Sep 2001 20:41:34 +0000 (20:41 +0000)]
Convert "max" to "mx" for variable names (brought to my attention by Steve
Henson). Also, reverse a previous change that used an implicit function
pointer cast rather than an explicit data pointer cast in the STACK cleanup
code.

18 years agoMake MD functions take EVP_MD_CTX * instead of void *, add copy() function.
Ben Laurie [Sun, 2 Sep 2001 20:05:27 +0000 (20:05 +0000)]
Make MD functions take EVP_MD_CTX * instead of void *, add copy() function.

18 years agoNote the "ex_data" changes.
Geoff Thorpe [Sat, 1 Sep 2001 20:20:16 +0000 (20:20 +0000)]
Note the "ex_data" changes.

18 years agoMake the necessary changes to work with the recent "ex_data" overhaul.
Geoff Thorpe [Sat, 1 Sep 2001 20:02:13 +0000 (20:02 +0000)]
Make the necessary changes to work with the recent "ex_data" overhaul.
See the commit log message for that for more information.

NB: X509_STORE_CTX's use of "ex_data" support was actually misimplemented
(initialisation by "memset" won't/can't/doesn't work). This fixes that but
requires that X509_STORE_CTX_init() be able to handle errors - so its
prototype has been changed to return 'int' rather than 'void'. All uses of
that function throughout the source code have been tracked down and
adjusted.

18 years agoFirst step in fixing "ex_data" support. Warning: big commit log ...
Geoff Thorpe [Sat, 1 Sep 2001 19:56:46 +0000 (19:56 +0000)]
First step in fixing "ex_data" support. Warning: big commit log ...

Currently, this change merely addresses where ex_data indexes are stored
and managed, and thus fixes the thread-safety issues that existed at that
level. "Class" code (eg. RSA, DSA, etc) no longer store their own STACKS
and per-class index counters - all such data is stored inside ex_data.c. So
rather than passing both STACK+counter to index-management ex_data
functions, a 'class_index' is instead passed to indicate the class (eg.
CRYPTO_EX_INDEX_RSA). New classes can be dynamically registered on-the-fly
and this is also thread-safe inside ex_data.c (though whether the caller
manages the return value in a thread-safe way is not addressed).

This does not change the "get/set" functions on individual "ex_data"
structures, and so thread-safety at that level isn't (yet) assured.
Likewise, the method of getting and storing per-class indexes has not
changed, so locking may still be required at the "caller" end but is
nonetheless thread-safe inside "ex_data"'s internal implementation.
Typically this occurs when code implements a new method of some kind and
stores its own per-class index in a global variable without locking the
setting and usage of that variable. If the code in question is likely to be
used in multiple threads, locking the setting and use of that index is
still up to the code in question. Possible fixes to this are being
sketched, but definitely require more major changes to the API itself than
this change undertakes.

The underlying implementation in ex_data.c has also been modularised so
that alternative "ex_data" implementations (that control all access to
state) can be plugged in. Eg. a loaded module can have its implementation
set to that of the application loaded it - the result being that
thread-safety and consistency of "ex_data" classes and indexes can be
maintained in the same place rather than the loaded module using its own
copy of ex_data support code and state.

Due to the centralisation of "state" with this change, cleanup of all
"ex_data" state can now be performed properly. Previously all allocation of
ex_data state was guaranteed to leak - and MemCheck_off() had been used to
avoid it flagging up the memory debugging. A new function has been added to
perfrom all this cleanup, CRYPTO_cleanup_all_ex_data(). The "openssl"
command(s) have been changed to use this cleanup, as have the relevant test
programs. External application code may want to do so too - failure to
cleanup will not induce more memory leaking than was the case before, but
the memory debugging is not tricked into hiding it any more so it may
"appear" where it previously did not.

18 years agoOnly OPENSSL_free() non-NULL pointers.
Geoff Thorpe [Sat, 1 Sep 2001 18:37:17 +0000 (18:37 +0000)]
Only OPENSSL_free() non-NULL pointers.

18 years agoundo, didn't work
Ulf Möller [Sat, 1 Sep 2001 05:59:27 +0000 (05:59 +0000)]
undo, didn't work

18 years ago*** empty log message ***
Ulf Möller [Sat, 1 Sep 2001 05:30:45 +0000 (05:30 +0000)]
*** empty log message ***

18 years agostrsep implementation to allow the file to compile on non-BSD systems
Ulf Möller [Sat, 1 Sep 2001 05:05:32 +0000 (05:05 +0000)]
strsep implementation to allow the file to compile on non-BSD systems

Submitted by: "Brian Havard" <brianh@kheldar.apana.org.au>

18 years agomake update
Ulf Möller [Sat, 1 Sep 2001 04:25:50 +0000 (04:25 +0000)]
make update

18 years agozlib default was broken on most platforms.
Ulf Möller [Sat, 1 Sep 2001 04:18:00 +0000 (04:18 +0000)]
zlib default was broken on most platforms.

-mcpu=i486 is new as of gcc 2.95, and if you have that, you wouldn't
want to optimize for 486 anyway.

18 years ago(A version of) gcc had been giving somewhat odd "trigraph" warnings about
Geoff Thorpe [Tue, 28 Aug 2001 19:32:16 +0000 (19:32 +0000)]
(A version of) gcc had been giving somewhat odd "trigraph" warnings about
this construct, and Ulf provided the following insight as to why;

> ANSI C compliant compilers must substitute "??)" for "]" because your
> terminal might not have a "]" key if you bought it in the early 1970s.

So we escape the final '?' to avoid this pathological case.

18 years agoEnsure that failure to create the BIO in 'CRYPTO_mem_leaks_fp' doesn't
Geoff Thorpe [Tue, 28 Aug 2001 15:54:57 +0000 (15:54 +0000)]
Ensure that failure to create the BIO in 'CRYPTO_mem_leaks_fp' doesn't
leave memory debugging turned off.
[Spotted by Götz Babin-Ebell]

18 years agoFix SSL memory leak.
Ben Laurie [Tue, 28 Aug 2001 13:45:41 +0000 (13:45 +0000)]
Fix SSL memory leak.

18 years agoMake sure "CRYPTO_mem_leaks_fp" doesn't itself create a reportable memory
Geoff Thorpe [Mon, 27 Aug 2001 22:12:56 +0000 (22:12 +0000)]
Make sure "CRYPTO_mem_leaks_fp" doesn't itself create a reportable memory
leak.

18 years ago"make update"
Geoff Thorpe [Sun, 26 Aug 2001 21:06:22 +0000 (21:06 +0000)]
"make update"

18 years agogcc can't spot that 'derlst' is not used uninitialised, so appease it.
Geoff Thorpe [Sun, 26 Aug 2001 21:04:21 +0000 (21:04 +0000)]
gcc can't spot that 'derlst' is not used uninitialised, so appease it.

18 years agoTest digests.
Ben Laurie [Sun, 26 Aug 2001 17:09:31 +0000 (17:09 +0000)]
Test digests.

18 years agoAdd digests.
Ben Laurie [Sun, 26 Aug 2001 17:09:00 +0000 (17:09 +0000)]
Add digests.

18 years agoTidy up some code formatting.
Geoff Thorpe [Sat, 25 Aug 2001 18:01:36 +0000 (18:01 +0000)]
Tidy up some code formatting.

18 years agoNote the "ERR" changes.
Geoff Thorpe [Sat, 25 Aug 2001 17:59:13 +0000 (17:59 +0000)]
Note the "ERR" changes.

18 years agoThis changes the "ERR" code to have all access to state (a hash table of
Geoff Thorpe [Sat, 25 Aug 2001 17:51:59 +0000 (17:51 +0000)]
This changes the "ERR" code to have all access to state (a hash table of
error strings and a hash table storing per-thread error state) go via an
ERR_FNS function table. The first time an ERR operation occurs, the
implementation that will be used (from then on) is set to the internal
"defaults" implementation if it has not already been set. The actual LHASH
tables are only accessed by this implementation.

This is primarily for modules that can be loaded at run-time and bound into
an application (or a shared-library version of OpenSSL). If the module has
its own statically-linked copy of OpenSSL code - this mechanism allows it
to *not* create and use ERR information in its own linked "ERR" code, but
instead to use and interact with the state stored in the loader
(application or shared library). The loader calls ERR_get_implementation()
and the return value is what the module should use when calling its own
copy of ERR_set_implementation().

18 years agoMake a note of the "up" functions.
Geoff Thorpe [Sat, 25 Aug 2001 17:37:46 +0000 (17:37 +0000)]
Make a note of the "up" functions.

18 years agoChanges crypto/evp/ and ssl/ code from directly incrementing reference
Geoff Thorpe [Sat, 25 Aug 2001 17:28:23 +0000 (17:28 +0000)]
Changes crypto/evp/ and ssl/ code from directly incrementing reference
counts in DH, DSA, and RSA structures. Instead they use the new "***_up()"
functions that handle this.

18 years agoGive DH, DSA, and RSA functions to "up" their reference counts. Otherwise,
Geoff Thorpe [Sat, 25 Aug 2001 17:24:21 +0000 (17:24 +0000)]
Give DH, DSA, and RSA functions to "up" their reference counts. Otherwise,
dependant code has to directly increment the "references" value of each
such structure using the corresponding lock. Apart from code duplication,
this provided no "REF_CHECK/REF_PRINT" checking and violated
encapsulation.

18 years agoAllow client certificate lists > 16kB ("Douglas E. Engert" <deengert@anl.gov>.)
Lutz Jänicke [Sat, 25 Aug 2001 11:49:24 +0000 (11:49 +0000)]
Allow client certificate lists > 16kB ("Douglas E. Engert" <deengert@anl.gov>.)

18 years agoWording of comment...
Lutz Jänicke [Sat, 25 Aug 2001 11:33:34 +0000 (11:33 +0000)]
Wording of comment...

18 years agoNeeded for build on SunOS 4.1.x with gcc (Jeffrey Hutzelman <jhutz@cmu.edu>).
Lutz Jänicke [Sat, 25 Aug 2001 11:31:19 +0000 (11:31 +0000)]
Needed for build on SunOS 4.1.x with gcc (Jeffrey Hutzelman <jhutz@cmu.edu>).

18 years agoMore docs.
Lutz Jänicke [Fri, 24 Aug 2001 14:29:48 +0000 (14:29 +0000)]
More docs.

18 years ago-passin argument not used when actually loading the key
Lutz Jänicke [Fri, 24 Aug 2001 13:33:15 +0000 (13:33 +0000)]
-passin argument not used when actually loading the key
(found by Massimiliano Pala <madwolf@hackmasters.net>).

18 years agoLoad OCSP responder key before waiting for an incoming
Dr. Stephen Henson [Thu, 23 Aug 2001 23:54:11 +0000 (23:54 +0000)]
Load OCSP responder key before waiting for an incoming
connection so it can prompt for pass phrase on startup
instead of after the first connection.

Add -port switch to usage message.

18 years agoAdd #ifdefs to some devcrypto code
Dr. Stephen Henson [Thu, 23 Aug 2001 23:52:38 +0000 (23:52 +0000)]
Add #ifdefs to some devcrypto code

18 years agoTypo.
Lutz Jänicke [Thu, 23 Aug 2001 17:41:20 +0000 (17:41 +0000)]
Typo.

18 years agoMore manual pages. Constify.
Lutz Jänicke [Thu, 23 Aug 2001 17:22:43 +0000 (17:22 +0000)]
More manual pages. Constify.

18 years agoAs discussed recently on openssl-users.
Lutz Jänicke [Thu, 23 Aug 2001 15:00:11 +0000 (15:00 +0000)]
As discussed recently on openssl-users.

18 years agoMake clear, that using the compression layer is currently not recommended.
Lutz Jänicke [Thu, 23 Aug 2001 09:42:12 +0000 (09:42 +0000)]
Make clear, that using the compression layer is currently not recommended.

18 years agotypo.
Ulf Möller [Wed, 22 Aug 2001 18:35:17 +0000 (18:35 +0000)]
typo.

18 years agoMore tests.
Ben Laurie [Wed, 22 Aug 2001 16:09:57 +0000 (16:09 +0000)]
More tests.

18 years agoOne more manual page...
Lutz Jänicke [Tue, 21 Aug 2001 14:54:54 +0000 (14:54 +0000)]
One more manual page...

18 years agoDocumentation on how to handle compression methods.
Lutz Jänicke [Tue, 21 Aug 2001 13:02:58 +0000 (13:02 +0000)]
Documentation on how to handle compression methods.
Hopefully it is clear enough, that it is currently not recommended.

18 years agoChecked in from the wrong !@#$%&*() copy...
Lutz Jänicke [Tue, 21 Aug 2001 07:27:02 +0000 (07:27 +0000)]
Checked in from the wrong !@#$%&*() copy...

18 years agoMore interdependencies with respect to shutdown behaviour.
Lutz Jänicke [Mon, 20 Aug 2001 14:34:16 +0000 (14:34 +0000)]
More interdependencies with respect to shutdown behaviour.

18 years agoAlert description strings for TLSv1 and documentation.
Lutz Jänicke [Sun, 19 Aug 2001 16:20:42 +0000 (16:20 +0000)]
Alert description strings for TLSv1 and documentation.

18 years agoAdd RC4 support to OpenBSD.
Ben Laurie [Sat, 18 Aug 2001 16:04:36 +0000 (16:04 +0000)]
Add RC4 support to OpenBSD.

18 years agoAdd AES tests.
Ben Laurie [Sat, 18 Aug 2001 16:02:52 +0000 (16:02 +0000)]
Add AES tests.

18 years agoAdd EVP test program.
Ben Laurie [Sat, 18 Aug 2001 13:53:01 +0000 (13:53 +0000)]
Add EVP test program.

18 years agoAdd first cut symmetric crypto support.
Ben Laurie [Sat, 18 Aug 2001 10:22:54 +0000 (10:22 +0000)]
Add first cut symmetric crypto support.

18 years agoMore details about session timeout settings.
Lutz Jänicke [Fri, 17 Aug 2001 16:36:51 +0000 (16:36 +0000)]
More details about session timeout settings.

18 years agoOne more function documented.
Lutz Jänicke [Fri, 17 Aug 2001 15:54:50 +0000 (15:54 +0000)]
One more function documented.

18 years agoSSL_shutdown() has even more properties...
Lutz Jänicke [Fri, 17 Aug 2001 15:09:31 +0000 (15:09 +0000)]
SSL_shutdown() has even more properties...

18 years agoOne more step on the way for complete documentation...
Lutz Jänicke [Fri, 17 Aug 2001 14:32:38 +0000 (14:32 +0000)]
One more step on the way for complete documentation...

18 years agoUnidirectional shutdown is allowed according to the RFC.
Lutz Jänicke [Fri, 17 Aug 2001 09:08:32 +0000 (09:08 +0000)]
Unidirectional shutdown is allowed according to the RFC.

18 years agoMake sure evil file name characters, like spaces or ampersands (!),
Richard Levitte [Fri, 17 Aug 2001 04:35:58 +0000 (04:35 +0000)]
Make sure evil file name characters, like spaces or ampersands (!),
don't disturb the rehashing process.
Spotted and suggested patch from Rudo Thomas <rudo@internet.sk>

18 years agoMake -passin -passout etc work again.
Dr. Stephen Henson [Fri, 17 Aug 2001 01:09:54 +0000 (01:09 +0000)]
Make -passin -passout etc work again.

Fix leak in ca.c when using -passin.

18 years agoAdd CRL utility functions to allow CRLs to be
Dr. Stephen Henson [Fri, 17 Aug 2001 00:33:43 +0000 (00:33 +0000)]
Add CRL utility functions to allow CRLs to be
built up without accessing structures directly.

Update ca.c to use new functions.

Fix ca.c so it now build CRLs correctly again.

18 years agoBugfixes provided by "Stephen Hinton" <shinton@netopia.com>.
Lutz Jänicke [Thu, 16 Aug 2001 15:28:00 +0000 (15:28 +0000)]
Bugfixes provided by "Stephen Hinton" <shinton@netopia.com>.

18 years agoBetter description of the behaviour of SSL_shutdown() as it is now, broken
Lutz Jänicke [Thu, 16 Aug 2001 14:27:55 +0000 (14:27 +0000)]
Better description of the behaviour of SSL_shutdown() as it is now, broken
or not.

18 years agogcc 3.0 tells me that -m486 is deprecated. The gcc 2.95 manual tells
Richard Levitte [Mon, 13 Aug 2001 14:09:31 +0000 (14:09 +0000)]
gcc 3.0 tells me that -m486 is deprecated.  The gcc 2.95 manual tells
me the same and that the correct option is -mcpu=i486.  I'm assuming
-mcpu has been around for some time, and that it's therefore safe to
change all occurences of -m486 to -mcpu=i486.

18 years agoThe indexes returned by ***_get_ex_new_index() functions are used when
Geoff Thorpe [Sun, 12 Aug 2001 17:14:35 +0000 (17:14 +0000)]
The indexes returned by ***_get_ex_new_index() functions are used when
setting stack (actually, array) values in ex_data. So only increment the
global counters if the underlying CRYPTO_get_ex_new_index() call succeeds.
This change doesn't make "ex_data" right (see the comment at the head of
ex_data.c to know why), but at least makes the source code marginally less
frustrating.

18 years agoThe indexes returned by ***_get_ex_new_index() functions are used when
Geoff Thorpe [Sun, 12 Aug 2001 16:52:00 +0000 (16:52 +0000)]
The indexes returned by ***_get_ex_new_index() functions are used when
setting stack (actually, array) values in ex_data. So only increment the
global counters if the underlying CRYPTO_get_ex_new_index() call succeeds.
This change doesn't make "ex_data" right (see the comment at the head of
ex_data.c to know why), but at least makes the source code marginally less
frustrating.

18 years agoMove CIPHER_CTX cleanups to _Final routines instead of _Init, which avoids
Ben Laurie [Sat, 11 Aug 2001 11:32:54 +0000 (11:32 +0000)]
Move CIPHER_CTX cleanups to _Final routines instead of _Init, which avoids
problems with leaks and uninitialised structures.

18 years agoApply the Tru64 patch from Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu>
Richard Levitte [Fri, 10 Aug 2001 15:26:21 +0000 (15:26 +0000)]
Apply the Tru64 patch from Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu>

His comments are:

1) Changes all references for `True64' to be `Tru64', which is the correct
spelling for the OS name.

2) Makes `alpha-cc' be the same as `alpha164-cc', and adds an `alphaold-cc'
entry that is the same as the previous `alpha-cc'.  The reason is that most
people these days are using the newer compiler, so it should be the default.

3) Adds a bit of commentary to Configure, regarding the name changes of
the OS over the years, so it's not so confusing to people that haven't been
with the OS for a while.

4) Adds an `alpha-cc-rpath' target (which is *not* selected automatically
by Configure under any circumstance) that builds an RPATH into the
shared libraries.  This is explained in the comment in Configure.  It's
very very useful for people that want it, and people that don't want it
just shouldn't choose that target.

5) Adds the `-pthread' flag as the best way to get POSIX thread support
from the newer compiler.

6) Updates the Makefile targets, so that when the `alpha164-cc', `alpha-cc',
or `alpha-cc-rpath' target is what Configure is set to use, it uses a Makefile
target that includes the `-msym' option when building the shared library.
This is a performance enhancement.

7) Updates `config' so that if it detects you're running version 4 or 5
of the OS, it automatically selects `alpha-cc', but uses `alphaold-cc'
for versions 1-3 of the OS.

8) Updates the comment in opensslv.h, fixing both the OS name typo and
adding a reference to IRIX 6.x, since the shared library semantics are
virtually identical there.

18 years agoadd missing link
Bodo Möller [Wed, 8 Aug 2001 15:09:06 +0000 (15:09 +0000)]
add missing link

18 years agoBugfix: larger message size in ssl3_get_key_exchange() because
Bodo Möller [Tue, 7 Aug 2001 09:30:18 +0000 (09:30 +0000)]
Bugfix: larger message size in ssl3_get_key_exchange() because
ServerKeyExchange message may be skipped.

Submitted by:  Petr Lampa <lampa@fee.vutbr.cz>

18 years agoFix typos (shinagawa@star.zko.dec.com)
Lutz Jänicke [Tue, 7 Aug 2001 07:52:53 +0000 (07:52 +0000)]
Fix typos (shinagawa@star.zko.dec.com)

18 years agoMore typedef'd struct names as search targets
Bodo Möller [Mon, 6 Aug 2001 11:57:08 +0000 (11:57 +0000)]
More typedef'd struct names as search targets

18 years agoReinsert typedef'ed names for structs to help those trying to read the
Bodo Möller [Mon, 6 Aug 2001 11:49:31 +0000 (11:49 +0000)]
Reinsert typedef'ed names for structs to help those trying to read the
sourcecode (including fgrep)

18 years agoStart to reduce some of the header bloat.
Ben Laurie [Sun, 5 Aug 2001 18:02:16 +0000 (18:02 +0000)]
Start to reduce some of the header bloat.

18 years agoFix memory leak.
Ben Laurie [Sun, 5 Aug 2001 16:13:49 +0000 (16:13 +0000)]
Fix memory leak.

18 years agoParameter correction for CIOFSESSION.
Ben Laurie [Sat, 4 Aug 2001 12:16:56 +0000 (12:16 +0000)]
Parameter correction for CIOFSESSION.

18 years agoRemove extra whitespace. Sorry.
Ben Laurie [Fri, 3 Aug 2001 21:09:21 +0000 (21:09 +0000)]
Remove extra whitespace. Sorry.

18 years agoReinstate accidentally deleted code.
Ben Laurie [Fri, 3 Aug 2001 19:00:43 +0000 (19:00 +0000)]
Reinstate accidentally deleted code.

18 years agoGet rid of the stuff we, err, got rid of.
Ben Laurie [Fri, 3 Aug 2001 18:52:50 +0000 (18:52 +0000)]
Get rid of the stuff we, err, got rid of.

18 years agoHeader bloat reduction for EVP_PKEY.
Ben Laurie [Fri, 3 Aug 2001 18:48:35 +0000 (18:48 +0000)]
Header bloat reduction for EVP_PKEY.

18 years agoThis ghastly hack prevents CVS wars over Kerberos (which is disabled by default).
Ben Laurie [Fri, 3 Aug 2001 18:45:35 +0000 (18:45 +0000)]
This ghastly hack prevents CVS wars over Kerberos (which is disabled by default).

18 years agoOops, one SSL_OP_NON_EXPORT_FIRST was left.
Lutz Jänicke [Fri, 3 Aug 2001 13:05:44 +0000 (13:05 +0000)]
Oops, one SSL_OP_NON_EXPORT_FIRST was left.

18 years agoMake /dev/crypto work with new EVP structures.
Ben Laurie [Fri, 3 Aug 2001 11:54:37 +0000 (11:54 +0000)]
Make /dev/crypto work with new EVP structures.

18 years agoMake sure memcpy() gets properly declared by including string.h.
Richard Levitte [Fri, 3 Aug 2001 10:54:00 +0000 (10:54 +0000)]
Make sure memcpy() gets properly declared by including string.h.

18 years agoremove a comma
Bodo Möller [Fri, 3 Aug 2001 09:28:02 +0000 (09:28 +0000)]
remove a comma

18 years agoDon't disable rollback attack detection as a recommended bug workaround.
Lutz Jänicke [Fri, 3 Aug 2001 08:45:13 +0000 (08:45 +0000)]
Don't disable rollback attack detection as a recommended bug workaround.

18 years agoMention removed option.
Lutz Jänicke [Wed, 1 Aug 2001 10:07:55 +0000 (10:07 +0000)]
Mention removed option.

18 years agoRemove SSL_OP_NON_EXPORT_FIRST:
Lutz Jänicke [Wed, 1 Aug 2001 10:06:32 +0000 (10:06 +0000)]
Remove SSL_OP_NON_EXPORT_FIRST:
It did not work, it was deactivated by #if 0/#endif anyway _and_ we now have
the working SSL_OP_CIPHER_SERVER_PREFERENCE.

18 years agomake update
Richard Levitte [Tue, 31 Jul 2001 17:07:24 +0000 (17:07 +0000)]
make update

18 years agoMake sure the source file is included among the dependencies. This is
Richard Levitte [Tue, 31 Jul 2001 17:02:44 +0000 (17:02 +0000)]
Make sure the source file is included among the dependencies.  This is
the norm for 'gcc -M' but not for 'makedepend', and is merely
introduced here to avoid commit wars.

18 years agoReworked manual pages with a lot of input from Bodo Moeller.
Lutz Jänicke [Tue, 31 Jul 2001 15:04:50 +0000 (15:04 +0000)]
Reworked manual pages with a lot of input from Bodo Moeller.

18 years agoDocument DES changes better.
Ben Laurie [Tue, 31 Jul 2001 13:33:58 +0000 (13:33 +0000)]
Document DES changes better.

18 years agoRemove old unused stuff.
Ben Laurie [Tue, 31 Jul 2001 12:03:26 +0000 (12:03 +0000)]
Remove old unused stuff.

18 years agoIndent.
Lutz Jänicke [Tue, 31 Jul 2001 10:19:20 +0000 (10:19 +0000)]
Indent.

18 years agoVade retro C++ comments!
Richard Levitte [Tue, 31 Jul 2001 09:15:52 +0000 (09:15 +0000)]
Vade retro C++ comments!

(Latin for "comments", anyone?)

18 years agoMake as sure as possible that gethostname() will be properly declared.
Richard Levitte [Tue, 31 Jul 2001 08:50:20 +0000 (08:50 +0000)]
Make as sure as possible that gethostname() will be properly declared.

18 years agoCorrect most of the unsigned vs. signed warnings (or int vs. size_t),
Richard Levitte [Tue, 31 Jul 2001 08:45:40 +0000 (08:45 +0000)]
Correct most of the unsigned vs. signed warnings (or int vs. size_t),
and rename some local variables to avoid name shadowing.

18 years agoWhoops, my fault, a backslash got converted to a slash...
Richard Levitte [Tue, 31 Jul 2001 08:44:28 +0000 (08:44 +0000)]
Whoops, my fault, a backslash got converted to a slash...

18 years agoMore Kerberos SSL changes from Jeffrey Altman <jaltman@columbia.edu>
Richard Levitte [Tue, 31 Jul 2001 07:21:06 +0000 (07:21 +0000)]
More Kerberos SSL changes from Jeffrey Altman <jaltman@columbia.edu>
His comments are:

First, it corrects a problem introduced in the last patch where the
kssl_map_enc() would intentionally return NULL for valid ENCTYPE
values.  This was done to prevent verification of the kerberos 5
authenticator from being performed when Derived Key ciphers were
in use.  Unfortunately, the authenticator verification routine was
not the only place that function was used.  And it caused core dumps.

Second, it attempt to add to SSL_SESSION the Kerberos 5 Client
Principal Name.

18 years agoRemove //.
Ben Laurie [Tue, 31 Jul 2001 06:47:23 +0000 (06:47 +0000)]
Remove //.

18 years agomake update
Richard Levitte [Tue, 31 Jul 2001 06:40:10 +0000 (06:40 +0000)]
make update

18 years agoReally add the EVP and all of the DES changes.
Ben Laurie [Mon, 30 Jul 2001 23:57:25 +0000 (23:57 +0000)]
Really add the EVP and all of the DES changes.

18 years agoMake EVPs allocate context memory, thus making them extensible. Rationalise
Ben Laurie [Mon, 30 Jul 2001 17:46:22 +0000 (17:46 +0000)]
Make EVPs allocate context memory, thus making them extensible. Rationalise
DES's keyschedules.

I know these two should be separate, and I'll back out the DES changes if they
are deemed to be an error.

Note that there is a memory leak lurking in SSL somewhere in this version.