openssl.git
9 years agoAdd flags functions which were added to 0.9.8 for fips but not 1.0.0 and
Dr. Stephen Henson [Tue, 26 Jan 2010 14:29:06 +0000 (14:29 +0000)]
Add flags functions which were added to 0.9.8 for fips but not 1.0.0 and
later.

9 years agoOPENSSL_isservice is now defined on all platforms not just WIN32
Dr. Stephen Henson [Tue, 26 Jan 2010 13:59:32 +0000 (13:59 +0000)]
OPENSSL_isservice is now defined on all platforms not just WIN32

9 years agoexport OPENSSL_isservice and make update
Dr. Stephen Henson [Tue, 26 Jan 2010 13:52:36 +0000 (13:52 +0000)]
export OPENSSL_isservice and make update

9 years agoTypo
Dr. Stephen Henson [Tue, 26 Jan 2010 12:30:00 +0000 (12:30 +0000)]
Typo

9 years agoparisc-mont.pl: PA-RISC 2.0 code path optimization based on intruction-
Andy Polyakov [Mon, 25 Jan 2010 23:12:00 +0000 (23:12 +0000)]
parisc-mont.pl: PA-RISC 2.0 code path optimization based on intruction-
level profiling data resulted in almost 50% performance improvement.
PA-RISC 1.1 is also reordered in same manner, mostly to be consistent,
as no gain was observed, not on PA-7100LC.

9 years agoPR: 2149
Dr. Stephen Henson [Mon, 25 Jan 2010 16:07:42 +0000 (16:07 +0000)]
PR: 2149
Submitted by: Douglas Stebila <douglas@stebila.ca>

Fix wap OIDs.

9 years agoThere's really no need to use $ENV::HOME
Richard Levitte [Mon, 25 Jan 2010 00:22:57 +0000 (00:22 +0000)]
There's really no need to use $ENV::HOME

9 years agoForgot to correct the definition of __arch in this file.
Richard Levitte [Mon, 25 Jan 2010 00:21:12 +0000 (00:21 +0000)]
Forgot to correct the definition of __arch in this file.
Submitted by Steven M. Schweda <sms@antinode.info>

9 years agoIt seems like sslroot: needs to be defined for some tests to work.
Richard Levitte [Mon, 25 Jan 2010 00:20:29 +0000 (00:20 +0000)]
It seems like sslroot: needs to be defined for some tests to work.
Submitted by Steven M. Schweda <sms@antinode.info>

9 years agoCompile t1_reneg on VMS as well.
Richard Levitte [Mon, 25 Jan 2010 00:19:31 +0000 (00:19 +0000)]
Compile t1_reneg on VMS as well.
Submitted by Steven M. Schweda <sms@antinode.info>

9 years agoA few more macros for long symbols.
Richard Levitte [Mon, 25 Jan 2010 00:18:29 +0000 (00:18 +0000)]
A few more macros for long symbols.
Submitted by Steven M. Schweda <sms@antinode.info>

9 years agoia64cpuid.S: OPENSSL_cleanse to accept zero length parameter.
Andy Polyakov [Sun, 24 Jan 2010 17:08:52 +0000 (17:08 +0000)]
ia64cpuid.S: OPENSSL_cleanse to accept zero length parameter.

9 years agoPR: 2153, 2125
Dr. Stephen Henson [Sun, 24 Jan 2010 16:57:20 +0000 (16:57 +0000)]
PR: 2153, 2125
Submitted by: steve@openssl.org

The original fix for PR#2125 broke compilation on some Unixware platforms:
revert and make conditional on VMS.

9 years agopariscid.pl: OPENSSL_cleanse to compile on PA-RISC 2.0W and to accept zero
Andy Polyakov [Sun, 24 Jan 2010 15:04:28 +0000 (15:04 +0000)]
pariscid.pl: OPENSSL_cleanse to compile on PA-RISC 2.0W and to accept zero
length parameter.

9 years agoOPENSSL_cleanse to accept zero length parameter [matching C implementation].
Andy Polyakov [Sun, 24 Jan 2010 14:54:24 +0000 (14:54 +0000)]
OPENSSL_cleanse to accept zero length parameter [matching C implementation].

9 years agoThe fix for PR#1949 unfortunately broke cases where the BIO_CTRL_WPENDING
Dr. Stephen Henson [Sun, 24 Jan 2010 13:54:20 +0000 (13:54 +0000)]
The fix for PR#1949 unfortunately broke cases where the BIO_CTRL_WPENDING
ctrl is incorrectly implemented (e.g. some versions of Apache). As a workaround
call both BIO_CTRL_INFO and BIO_CTRL_WPENDING if it returns zero. This should
both address the original bug and retain compatibility with the old behaviour.

9 years agoTolerate PKCS#8 DSA format with negative private key.
Dr. Stephen Henson [Fri, 22 Jan 2010 20:17:12 +0000 (20:17 +0000)]
Tolerate PKCS#8 DSA format with negative private key.

9 years agoIf legacy renegotiation is not permitted then send a fatal alert if a patched
Dr. Stephen Henson [Fri, 22 Jan 2010 18:49:34 +0000 (18:49 +0000)]
If legacy renegotiation is not permitted then send a fatal alert if a patched
server attempts to renegotiate with an unpatched client.

9 years agotypo
Dr. Stephen Henson [Thu, 21 Jan 2010 18:46:15 +0000 (18:46 +0000)]
typo

9 years agofix comments
Dr. Stephen Henson [Thu, 21 Jan 2010 01:17:17 +0000 (01:17 +0000)]
fix comments

9 years agooops
Dr. Stephen Henson [Wed, 20 Jan 2010 17:59:53 +0000 (17:59 +0000)]
oops

9 years agoupdate NEWS file
Dr. Stephen Henson [Wed, 20 Jan 2010 17:56:34 +0000 (17:56 +0000)]
update NEWS file

9 years agoUpdate demo
Dr. Stephen Henson [Wed, 20 Jan 2010 14:06:21 +0000 (14:06 +0000)]
Update demo

9 years agoSupport -L options in VC++ link.
Dr. Stephen Henson [Wed, 20 Jan 2010 14:04:44 +0000 (14:04 +0000)]
Support -L options in VC++ link.

9 years agorand_win.c: fix time limit logic.
Andy Polyakov [Tue, 19 Jan 2010 20:35:22 +0000 (20:35 +0000)]
rand_win.c: fix time limit logic.

9 years agoThe use of NIDs in the password based encryption table can result in
Dr. Stephen Henson [Tue, 19 Jan 2010 19:56:06 +0000 (19:56 +0000)]
The use of NIDs in the password based encryption table can result in
algorithms not found when an application uses PKCS#12 and only calls
SSL_library_init() instead of OpenSSL_add_all_algorithms(). Simple
work around is to add the missing algorithm (40 bit RC2) in
SSL_library_init().

9 years agoPR: 2141
Dr. Stephen Henson [Tue, 19 Jan 2010 19:28:18 +0000 (19:28 +0000)]
PR: 2141
Submitted by: "NARUSE, Yui" <naruse@airemix.jp>

Remove non-ASCII comment which causes compilation errors on some versions
of VC++.

9 years agoPR: 2144
Dr. Stephen Henson [Tue, 19 Jan 2010 19:11:35 +0000 (19:11 +0000)]
PR: 2144
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Better fix for PR#2144

9 years agoEnable PA-RISC assembler in Configure (feedback from PA-RISC 2.0 is still
Andy Polyakov [Tue, 19 Jan 2010 17:10:24 +0000 (17:10 +0000)]
Enable PA-RISC assembler in Configure (feedback from PA-RISC 2.0 is still
needed).

9 years agox86_64-xlate.pl: refine sign extension logic when handling lea.
Andy Polyakov [Tue, 19 Jan 2010 16:15:23 +0000 (16:15 +0000)]
x86_64-xlate.pl: refine sign extension logic when handling lea.
PR: 2094,2095

9 years agorand_win.c: handle GetTickCount wrap-around.
Andy Polyakov [Tue, 19 Jan 2010 13:48:18 +0000 (13:48 +0000)]
rand_win.c: handle GetTickCount wrap-around.

9 years agos390x assembler update: add support for run-time facility detection.
Andy Polyakov [Tue, 19 Jan 2010 12:24:59 +0000 (12:24 +0000)]
s390x assembler update: add support for run-time facility detection.

9 years agoapps/speed.c: limit loop counters to 2^31 in order to avoid overflows
Andy Polyakov [Sun, 17 Jan 2010 17:31:38 +0000 (17:31 +0000)]
apps/speed.c: limit loop counters to 2^31 in order to avoid overflows
in performance calculations. For the moment there is only one code
fast enough to suffer from this: Intel AES-NI engine.
PR: 2096

9 years agoMinor updates to ppccap.c and ppccpuid.pl.
Andy Polyakov [Sun, 17 Jan 2010 13:44:14 +0000 (13:44 +0000)]
Minor updates to ppccap.c and ppccpuid.pl.

9 years agobn_lcl.h: add MIPS III-specific BN_UMULT_LOHI as alternative to porting
Andy Polyakov [Sun, 17 Jan 2010 12:08:24 +0000 (12:08 +0000)]
bn_lcl.h: add MIPS III-specific BN_UMULT_LOHI as alternative to porting
crypto/bn/asm/mips3.s from IRIX. Performance improvement is not as
impressive as with complete assembler, but still... it's almost 2.5x
[on R5000].

9 years agoia64-mont.pl: add shorter vector support ("shorter" refers to 512 bits and
Andy Polyakov [Sun, 17 Jan 2010 11:33:59 +0000 (11:33 +0000)]
ia64-mont.pl: add shorter vector support ("shorter" refers to 512 bits and
less).

9 years agoPR: 2135
Dr. Stephen Henson [Sat, 16 Jan 2010 20:05:59 +0000 (20:05 +0000)]
PR: 2135
Submitted by: Mike Frysinger <vapier@gentoo.org>

Change missed references to lib to $(LIBDIR)

9 years agoPR: 2144
Dr. Stephen Henson [Sat, 16 Jan 2010 19:46:10 +0000 (19:46 +0000)]
PR: 2144
Submitted by: steve@openssl.org

Fix DTLS connection so new_session is reset if we read second client hello:
new_session is used to detect renegotiation.

9 years agoPR: 2133
Dr. Stephen Henson [Sat, 16 Jan 2010 19:20:52 +0000 (19:20 +0000)]
PR: 2133
Submitted by: steve@openssl.org

Add missing DTLS state strings.

9 years agoconvert to Unix EOL form
Dr. Stephen Henson [Fri, 15 Jan 2010 15:26:12 +0000 (15:26 +0000)]
convert to Unix EOL form

9 years agomake update
Dr. Stephen Henson [Fri, 15 Jan 2010 15:24:19 +0000 (15:24 +0000)]
make update

9 years agoPR: 2125
Dr. Stephen Henson [Thu, 14 Jan 2010 17:51:29 +0000 (17:51 +0000)]
PR: 2125
Submitted by: "Alon Bar-Lev" <alon.barlev@gmail.com>

Fix gcc-aix compilation issue.

9 years agoFix version handling so it can cope with a major version >3.
Dr. Stephen Henson [Wed, 13 Jan 2010 19:08:02 +0000 (19:08 +0000)]
Fix version handling so it can cope with a major version >3.

Although it will be many years before TLS v2.0 or later appears old versions
of servers have a habit of hanging around for a considerable time so best
if we handle this properly now.

9 years agoModify compression code so it avoids using ex_data free functions. This
Dr. Stephen Henson [Wed, 13 Jan 2010 18:57:40 +0000 (18:57 +0000)]
Modify compression code so it avoids using ex_data free functions. This
stops applications that call CRYPTO_free_all_ex_data() prematurely leaking
memory.

9 years agoupdate and sync ordinals
Dr. Stephen Henson [Tue, 12 Jan 2010 17:34:39 +0000 (17:34 +0000)]
update and sync ordinals

9 years agoPR: 2136
Dr. Stephen Henson [Tue, 12 Jan 2010 17:29:34 +0000 (17:29 +0000)]
PR: 2136
Submitted by: Willy Weisz <weisz@vcpc.univie.ac.at>

Add options to output hash using older algorithm compatible with OpenSSL
versions before 1.0.0

9 years agoSimplify RI+SCSV logic:
Dr. Stephen Henson [Thu, 7 Jan 2010 19:04:52 +0000 (19:04 +0000)]
Simplify RI+SCSV logic:

1. Send SCSV is not renegotiating, never empty RI.
2. Send RI if renegotiating.

9 years agoia64-mont.pl: addp4 is not needed when referring to stack (this is 32-bit
Andy Polyakov [Thu, 7 Jan 2010 15:36:59 +0000 (15:36 +0000)]
ia64-mont.pl: addp4 is not needed when referring to stack (this is 32-bit
HP-UX thing).

9 years agohttp://cvs.openssl.org/chngview?cn=19053 made me wonder if bind() and
Andy Polyakov [Thu, 7 Jan 2010 13:12:30 +0000 (13:12 +0000)]
cvs.openssl.org/chngview?cn=19053 made me wonder if bind() and
connect() are as finicky as sendto() when it comes to socket address
length. As it turned out they are, therefore the fix. Note that you
can't reproduce the problem on Linux, it was failing on Solaris,
FreeBSD, most likely on more...

9 years agosendto is reportedly picky about destination socket address length.
Andy Polyakov [Thu, 7 Jan 2010 10:42:39 +0000 (10:42 +0000)]
sendto is reportedly picky about destination socket address length.
PR: 2114
Submitted by: Robin Seggelmann

9 years agoFix compilation on older Linux. Linux didn't always have sockaddr_storage,
Andy Polyakov [Wed, 6 Jan 2010 21:22:56 +0000 (21:22 +0000)]
Fix compilation on older Linux. Linux didn't always have sockaddr_storage,
not to mention that first sockaddr_storage had __ss_family, not ss_family.
In other words it makes more sense to avoid sockaddr_storage...

9 years agoUpdates to conform with draft-ietf-tls-renegotiation-03.txt:
Dr. Stephen Henson [Wed, 6 Jan 2010 17:37:09 +0000 (17:37 +0000)]
Updates to conform with draft-ietf-tls-renegotiation-03.txt:

1. Add provisional SCSV value.
2. Don't send SCSV and RI at same time.
3. Fatal error is SCSV received when renegotiating.

9 years agoMissing commit from change ofr compress_meth to unsigned
Dr. Stephen Henson [Wed, 6 Jan 2010 17:35:27 +0000 (17:35 +0000)]
Missing commit from change ofr compress_meth to unsigned

9 years agocompress_meth should be unsigned
Dr. Stephen Henson [Wed, 6 Jan 2010 14:01:45 +0000 (14:01 +0000)]
compress_meth should be unsigned

9 years agoENGINE_load_capi() now exists on all platforms (but no op on non-WIN32)
Dr. Stephen Henson [Wed, 6 Jan 2010 13:21:08 +0000 (13:21 +0000)]
ENGINE_load_capi() now exists on all platforms (but no op on non-WIN32)

9 years agoppc64-mont.pl: commentary update.
Andy Polyakov [Wed, 6 Jan 2010 10:58:59 +0000 (10:58 +0000)]
ppc64-mont.pl: commentary update.

9 years agoAdd Montgomery multiplication module for IA-64.
Andy Polyakov [Wed, 6 Jan 2010 10:57:55 +0000 (10:57 +0000)]
Add Montgomery multiplication module for IA-64.

9 years agoPR: 2102
Dr. Stephen Henson [Tue, 5 Jan 2010 17:57:33 +0000 (17:57 +0000)]
PR: 2102
Submitted by: John Fitzgibbon <john_fitzgibbon@yahoo.com>

Remove duplicate definitions.

9 years agoTypo
Dr. Stephen Henson [Tue, 5 Jan 2010 17:49:49 +0000 (17:49 +0000)]
Typo

9 years agoPR: 2132
Dr. Stephen Henson [Tue, 5 Jan 2010 17:32:54 +0000 (17:32 +0000)]
PR: 2132
Submitted by: steve

Fix bundled pod2man.pl to handle alternative comment formats.

9 years agoRemove tabs on blank lines: they produce warnings in pod2man
Dr. Stephen Henson [Tue, 5 Jan 2010 17:16:54 +0000 (17:16 +0000)]
Remove tabs on blank lines: they produce warnings in pod2man

9 years agoClient side compression algorithm sanity checks: ensure old compression
Dr. Stephen Henson [Fri, 1 Jan 2010 14:39:37 +0000 (14:39 +0000)]
Client side compression algorithm sanity checks: ensure old compression
algorithm matches current and give error if compression is disabled and
server requests it (shouldn't happen unless server is broken).

9 years agoCompression handling on session resume was badly broken: it always
Dr. Stephen Henson [Thu, 31 Dec 2009 14:13:30 +0000 (14:13 +0000)]
Compression handling on session resume was badly broken: it always
used compression algorithms in client hello (a legacy from when
the compression algorithm wasn't serialized with SSL_SESSION).

9 years agoInclude CHANGES entry for external cache
Dr. Stephen Henson [Thu, 31 Dec 2009 13:58:57 +0000 (13:58 +0000)]
Include CHANGES entry for external cache

9 years agob_sock.c: correct indirect calls on WinSock platforms.
Andy Polyakov [Wed, 30 Dec 2009 12:55:23 +0000 (12:55 +0000)]
b_sock.c: correct indirect calls on WinSock platforms.
PR: 2130
Submitted by: Eugeny Gostyukhin

9 years agoAdapt mingw config for newer mingw environment. Note modified conditional
Andy Polyakov [Wed, 30 Dec 2009 11:46:54 +0000 (11:46 +0000)]
Adapt mingw config for newer mingw environment. Note modified conditional
compilation in e_capi.c.
PR: 2113

9 years agoppccap.c: fix compiler warning and perform sanity check outside signal masking.
Andy Polyakov [Tue, 29 Dec 2009 11:18:16 +0000 (11:18 +0000)]
ppccap.c: fix compiler warning and perform sanity check outside signal masking.
ppc64-mont.pl: clarify comment and fix spelling.

9 years agoDeploy multilib config-line parameter. It was added in February to allow
Andy Polyakov [Tue, 29 Dec 2009 10:33:37 +0000 (10:33 +0000)]
Deploy multilib config-line parameter. It was added in February to allow
for kind of installation suggested in ticket #2003 from August. What it
effectively does now, is arrange pre-configured default $libdir value.
Note that it also fixes ENGINESDIR, i.e. harmonizes it with install path.

9 years agoPA-RISC assembler: missing symbol and typos.
Andy Polyakov [Mon, 28 Dec 2009 16:13:35 +0000 (16:13 +0000)]
PA-RISC assembler: missing symbol and typos.

9 years agoreturn v1.1 methods for client/server
Dr. Stephen Henson [Mon, 28 Dec 2009 00:31:16 +0000 (00:31 +0000)]
return v1.1 methods for client/server

9 years agoAdd simple external session cache to s_server. This serialises sessions
Dr. Stephen Henson [Sun, 27 Dec 2009 23:24:45 +0000 (23:24 +0000)]
Add simple external session cache to s_server. This serialises sessions
just like a "real" server making it easier to trace any problems.

9 years agoTypo
Dr. Stephen Henson [Sun, 27 Dec 2009 23:02:50 +0000 (23:02 +0000)]
Typo

9 years agoUpdate RI to match latest spec.
Dr. Stephen Henson [Sun, 27 Dec 2009 22:58:55 +0000 (22:58 +0000)]
Update RI to match latest spec.

MCSV is now called SCSV.

Don't send SCSV if renegotiating.

Also note if RI is empty in debug messages.

9 years agoUpdate sha512-parisc.pl and add make rules.
Andy Polyakov [Sun, 27 Dec 2009 21:05:19 +0000 (21:05 +0000)]
Update sha512-parisc.pl and add make rules.

9 years agoThrow in more PA-RISC assembler.
Andy Polyakov [Sun, 27 Dec 2009 20:49:40 +0000 (20:49 +0000)]
Throw in more PA-RISC assembler.

9 years agoSwitch to new uplink assembler.
Andy Polyakov [Sun, 27 Dec 2009 20:38:32 +0000 (20:38 +0000)]
Switch to new uplink assembler.

9 years agoppccap.c: tidy up.
Andy Polyakov [Sun, 27 Dec 2009 11:25:24 +0000 (11:25 +0000)]
ppccap.c: tidy up.
ppc64-mont.pl: missing predicate in commentary.

9 years agoppc64-mont.pl: adapt for 32-bit and engage for all builds.
Andy Polyakov [Sat, 26 Dec 2009 21:30:13 +0000 (21:30 +0000)]
ppc64-mont.pl: adapt for 32-bit and engage for all builds.

9 years agoTraditional Yuletide commit ;-)
Dr. Stephen Henson [Fri, 25 Dec 2009 14:13:11 +0000 (14:13 +0000)]
Traditional Yuletide commit ;-)

Add Triple DES CFB1 and CFB8 to algorithm list and NID translation.

9 years agoUse properly local variables for thread-safety.
Bodo Möller [Tue, 22 Dec 2009 11:52:17 +0000 (11:52 +0000)]
Use properly local variables for thread-safety.

Submitted by: Martin Rex

9 years agoConstify crypto/cast.
Bodo Möller [Tue, 22 Dec 2009 11:46:00 +0000 (11:46 +0000)]
Constify crypto/cast.

9 years agoConstify crypto/cast.
Bodo Möller [Tue, 22 Dec 2009 10:58:33 +0000 (10:58 +0000)]
Constify crypto/cast.

9 years agoAlert to use is now defined in spec: update code
Dr. Stephen Henson [Thu, 17 Dec 2009 15:42:52 +0000 (15:42 +0000)]
Alert to use is now defined in spec: update code

9 years agoPR: 2127
Dr. Stephen Henson [Thu, 17 Dec 2009 15:27:57 +0000 (15:27 +0000)]
PR: 2127
Submitted by: Tomas Mraz <tmraz@redhat.com>

Check for lookup failures in EVP_PBE_CipherInit().

9 years agoNew option to enable/disable connection to unpatched servers
Dr. Stephen Henson [Wed, 16 Dec 2009 20:25:59 +0000 (20:25 +0000)]
New option to enable/disable connection to unpatched servers

9 years agoAllow initial connection (but no renegoriation) to servers which don't support
Dr. Stephen Henson [Mon, 14 Dec 2009 13:56:04 +0000 (13:56 +0000)]
Allow initial connection (but no renegoriation) to servers which don't support
RI.

Reorganise RI checking code and handle some missing cases.

9 years agoMove SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION out of SSL_OP_ALL and move SSL_OP_NO_TL...
Dr. Stephen Henson [Fri, 11 Dec 2009 00:23:12 +0000 (00:23 +0000)]
Move SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION out of SSL_OP_ALL and move SSL_OP_NO_TLSv1_1

9 years agoclarify docs
Dr. Stephen Henson [Wed, 9 Dec 2009 18:16:50 +0000 (18:16 +0000)]
clarify docs

9 years agoDocument option clearning functions.
Dr. Stephen Henson [Wed, 9 Dec 2009 17:59:29 +0000 (17:59 +0000)]
Document option clearning functions.

Initial secure renegotiation documentation.

9 years agoremove DEBUG_UNUSED from config for now
Dr. Stephen Henson [Wed, 9 Dec 2009 15:56:24 +0000 (15:56 +0000)]
remove DEBUG_UNUSED from config for now

9 years agoCheck s3 is not NULL
Dr. Stephen Henson [Wed, 9 Dec 2009 15:03:44 +0000 (15:03 +0000)]
Check s3 is not NULL

9 years agoAdd patch to crypto/evp which didn't apply from PR#2124
Dr. Stephen Henson [Wed, 9 Dec 2009 15:01:39 +0000 (15:01 +0000)]
Add patch to crypto/evp which didn't apply from PR#2124

9 years agoRevert lhash patch for PR#2124
Dr. Stephen Henson [Wed, 9 Dec 2009 14:59:47 +0000 (14:59 +0000)]
Revert lhash patch for PR#2124

9 years agoPR: 2124
Dr. Stephen Henson [Wed, 9 Dec 2009 13:38:05 +0000 (13:38 +0000)]
PR: 2124
Submitted by: Jan Pechanec <Jan.Pechanec@Sun.COM>

Check for memory allocation failures.

9 years agoAdd ctrls to clear options and mode.
Dr. Stephen Henson [Wed, 9 Dec 2009 13:25:16 +0000 (13:25 +0000)]
Add ctrls to clear options and mode.

Change RI ctrl so it doesn't clash.

9 years agoSend no_renegotiation alert as required by spec.
Dr. Stephen Henson [Tue, 8 Dec 2009 19:06:26 +0000 (19:06 +0000)]
Send no_renegotiation alert as required by spec.

9 years agoAdd ctrl and macro so we can determine if peer support secure renegotiation.
Dr. Stephen Henson [Tue, 8 Dec 2009 13:42:08 +0000 (13:42 +0000)]
Add ctrl and macro so we can determine if peer support secure renegotiation.

9 years agoAdd support for magic cipher suite value (MCSV). Make secure renegotiation
Dr. Stephen Henson [Tue, 8 Dec 2009 13:14:03 +0000 (13:14 +0000)]
Add support for magic cipher suite value (MCSV). Make secure renegotiation
work in SSLv3: initial handshake has no extensions but includes MCSV, if
server indicates RI support then renegotiation handshakes include RI.

NB: current MCSV value is bogus for testing only, will be updated when we
have an official value.

Change mismatch alerts to handshake_failure as required by spec.

Also have some debugging fprintfs so we can clearly see what is going on
if OPENSSL_RI_DEBUG is set.

9 years agoPR: 2121
Dr. Stephen Henson [Tue, 8 Dec 2009 11:37:40 +0000 (11:37 +0000)]
PR: 2121
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>

Add extension support to DTLS code mainly using existing implementation for
TLS.

9 years agoInitial experimental TLSv1.1 support
Dr. Stephen Henson [Mon, 7 Dec 2009 13:31:02 +0000 (13:31 +0000)]
Initial experimental TLSv1.1 support