mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-27 05:21:51 +08:00
Code Issues Packages Projects Releases Wiki Activity
11,225 Commits 33 Branches 385 Tags 484 MiB
08e5536445
Commit Graph

11225 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Andy Polyakov
2dce10c56d sha256-586.pl: fix typos. 2012-07-01 08:46:38 +00:00
Dr. Stephen Henson
18d7158809 Add certificate callback. If set this is called whenever a certificate 
is required by client or server. An application can decide which
certificate chain to present based on arbitrary criteria: for example
supported signature algorithms. Add very simple example to s_server.
This fixes many of the problems and restrictions of the existing client
certificate callback: for example you can now clear existing certificates
and specify the whole chain.
 2012-06-29 14:24:42 +00:00
Dr. Stephen Henson
0f39bab0df Function tls1_check_ec_server_key is now redundant as we make 
appropriate checks in tls1_check_chain.
 2012-06-28 13:02:14 +00:00
Dr. Stephen Henson
d61ff83be9 Add new "valid_flags" field to CERT_PKEY structure which determines what 
the certificate can be used for (if anything). Set valid_flags field
in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
to have similar checks in it.

Add new "cert_flags" field to CERT structure and include a "strict mode".
This enforces some TLS certificate requirements (such as only permitting
certificate signature algorithms contained in the supported algorithms
extension) which some implementations ignore: this option should be used
with caution as it could cause interoperability issues.
 2012-06-28 12:45:49 +00:00
Dr. Stephen Henson
be681e123c don't use pseudo digests for default values of keys 2012-06-27 14:12:47 +00:00
Andy Polyakov
6251989eb6 x86_64 assembly pack: make it possible to compile with Perl located on 
path with spaces.

PR: 2835
 2012-06-27 10:08:23 +00:00
Andy Polyakov
faee82c1bc sha512-x86_64.pl: fix typo. 2012-06-25 17:13:15 +00:00
Dr. Stephen Henson
4453cd8c73 Reorganise supported signature algorithm extension processing. 
Only store encoded versions of peer and configured signature algorithms.
Determine shared signature algorithms and cache the result along with NID
equivalents of each algorithm.
 2012-06-25 14:32:30 +00:00
Andy Polyakov
a8f3b8b519 sha512-x86_64.pl: add SIMD code paths. 2012-06-24 19:22:06 +00:00
Dr. Stephen Henson
0f229cce65 Add support for application defined signature algorithms for use with 
TLS v1.2. These are sent as an extension for clients and during a certificate
request for servers.

TODO: add support for shared signature algorithms, respect shared algorithms
when deciding which ciphersuites and certificates to permit.
 2012-06-22 14:03:31 +00:00
Dr. Stephen Henson
020091406c oops, add -debug_decrypt option which was accidenatally left out 2012-06-19 13:39:30 +00:00
Andy Polyakov
ad880dc469 sha512-x86_64.pl: fix typo. 2012-06-19 07:50:10 +00:00
Andy Polyakov
42a36658c1 sha256-586.pl: fix linking error. 2012-06-19 07:49:36 +00:00
Dr. Stephen Henson
c4ff5d1147 fix clashing error code 2012-06-18 13:11:09 +00:00
Dr. Stephen Henson
a5ee80b910 Make it possible to delete all certificates from an SSL structure. 2012-06-18 12:56:59 +00:00
Dr. Stephen Henson
93ab9e421e Initial record tracing code. Print out all fields in SSL/TLS records 
for debugging purposes. Needs "enable-ssl-trace" configuration option.
 2012-06-15 12:46:09 +00:00
Dr. Stephen Henson
dfcf48f499 New functions to retrieve certificate signatures and signature OID NID. 2012-06-13 13:08:12 +00:00
Andy Polyakov
0bf8f110e0 sha256t.c: make sure unrolled loop is tested. 2012-06-12 14:40:41 +00:00
Andy Polyakov
f3eac74bc5 sha256-586.pl: add AVX and XOP code paths. 2012-06-12 14:40:11 +00:00
Andy Polyakov
3a9b3852c6 sha256-586.pl: squeeze some more, most notably ~10% on Nehalem. 2012-06-12 14:38:01 +00:00
Andy Polyakov
d2e1803197 x86[_64] assembly pack: update benchmark results. 2012-06-12 14:18:21 +00:00
Dr. Stephen Henson
4b9e0b5f74 print out issuer and subject unique identifier fields in certificates 2012-06-12 13:41:18 +00:00
Andy Polyakov
447e1319b1 bss_dgram.c: add BIO_CTRL_DGRAM_SET_DONT_FRAG. 
PR: 2830
Submitted by: Robin Seggelmann
 2012-06-11 14:56:25 +00:00
Andy Polyakov
e77ec2ba6f bss_dgram.c: make getsockopt work in cases when optlen is 64-bit value. 2012-06-11 14:27:56 +00:00
Ben Laurie
195b9eeeed Fix memory leak. 2012-06-11 09:23:55 +00:00
Andy Polyakov
80c42f3e0c b_sock.c: make getsockopt work in cases when optlen is 64-bit value. 2012-06-11 08:52:11 +00:00
Ben Laurie
7a71af86ce Rearrange and test authz extension. 2012-06-07 13:20:47 +00:00
Ben Laurie
32e62d1cc4 Fix memory leak. 2012-06-06 13:03:42 +00:00
Ben Laurie
aeda172afd Parse authz correctly. 2012-06-06 12:52:19 +00:00
Andy Polyakov
8d1b199d26 Revert random changes from commit#22606. 2012-06-04 22:12:10 +00:00
Ben Laurie
71fa451343 Version skew reduction: trivia (I hope). 2012-06-03 22:00:21 +00:00
Ben Laurie
a9e1c50bb0 RFC 5878 support. 2012-05-30 10:10:58 +00:00
Ben Laurie
03c1d9f99d Build on FreeBSD with gcc 4.6. 2012-05-30 09:34:44 +00:00
Andy Polyakov
f889bb0384 sha256-586.pl: full unroll to deliver additional ~16%, add Sandy Bridge- 
specific code path.
 2012-05-28 17:50:57 +00:00
Andy Polyakov
83698d3191 sha512-x86_64.pl: >5% better performance. 2012-05-28 17:47:15 +00:00
Andy Polyakov
6a40ebe86b aesni-x86_64.pl: make it possibel to use in Linux kernel. 2012-05-24 07:39:44 +00:00
Andy Polyakov
d4bb6bddf8 sha256-586.pl: tune away regression on Nehalem core and incidentally 
improve performance on Atom and P4.
 2012-05-24 07:39:04 +00:00
Andy Polyakov
ee9bf3eb6c sha256-586.pl optimization. 2012-05-19 10:10:30 +00:00
Andy Polyakov
41409651be s2_clnt.c: compensate for compiler bug. 2012-05-16 12:47:36 +00:00
Andy Polyakov
fd05495748 ppccap.c: assume no features under 32-bit AIX kernel. 
PR: 2810
 2012-05-16 12:42:32 +00:00
Dr. Stephen Henson
4242a090c7 PR: 2813 
Reported by: Constantine Sapuntzakis <csapuntz@gmail.com>

Fix possible deadlock when decoding public keys.
 2012-05-11 13:53:37 +00:00
Dr. Stephen Henson
c3b1303387 PR: 2811 
Reported by: Phil Pennock <openssl-dev@spodhuis.org>

Make renegotiation work for TLS 1.2, 1.1 by not using a lower record
version client hello workaround if renegotiating.
 2012-05-11 13:34:29 +00:00
Ben Laurie
5762f7778d Fix warning. 2012-05-10 20:29:00 +00:00
Ben Laurie
7a412ded50 Padlock doesn't build. I don't even know what it is. 2012-05-10 20:28:02 +00:00
Dr. Stephen Henson
efb19e1330 PR: 2806 
Submitted by: PK <runningdoglackey@yahoo.com>

Correct ciphersuite signature algorithm definitions.
 2012-05-10 18:25:39 +00:00
Dr. Stephen Henson
c46ecc3a55 Sanity check record length before skipping explicit IV in TLS 1.2, 1.1 and 
DTLS to fix DoS attack.

Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
fuzzing as a service testing platform.
(CVE-2012-2333)
 2012-05-10 16:03:52 +00:00
Dr. Stephen Henson
7388b43cae update FAQ 2012-05-10 15:37:16 +00:00
Dr. Stephen Henson
225055c30b Reported by: Solar Designer of Openwall 
Make sure tkeylen is initialised properly when encrypting CMS messages.
 2012-05-10 13:46:09 +00:00
Richard Levitte
e0311481b8 Correct environment variable is OPENSSL_ALLOW_PROXY_CERTS. 2012-05-04 10:43:15 +00:00
Andy Polyakov
f9c5e5d92e perlasm: fix symptom-less bugs, missing semicolons and 'my' declarations. 2012-04-28 10:36:58 +00:00