mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-23 14:42:15 +08:00
Code Issues Packages Projects Releases Wiki Activity
43341433a8
openssl/apps
History
Viktor Dukhovni 43341433a8 Suppress CT callback as appropriate 
Suppress CT callbacks with aNULL or PSK ciphersuites that involve
no certificates.  Ditto when the certificate chain is validated via
DANE-TA(2) or DANE-EE(3) TLSA records.  Also skip SCT processing
when the chain is fails verification.

Move and consolidate CT callbacks from libcrypto to libssl.  We
also simplify the interface to SSL_{,CTX_}_enable_ct() which can
specify either a permissive mode that just collects information or
a strict mode that requires at least one valid SCT or else asks to
abort the connection.

Simplified SCT processing and options in s_client(1) which now has
just a simple pair of "-noct" vs. "-ct" options, the latter enables
the permissive callback so that we can complete the handshake and
report all relevant information.  When printing SCTs, print the
validation status if set and not valid.

Signed-off-by: Rob Percival <robpercival@google.com>
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-04-07 14:41:34 -04:00
..
demoCA
demoSRP
app_rand.c Add a no-egd option to disable EGD-related code 2016-01-14 13:02:51 -05:00
apps.c Revert "various spelling fixes" 2016-04-04 16:11:43 -04:00
apps.h Move peer chain security checks into x509_vfy.c 2016-04-03 11:35:35 -04:00
asn1pars.c argv was set but unused 2016-02-20 14:53:53 +01:00
build.info Make the use of perl more consistent 2016-04-01 07:24:04 +02:00
ca-cert.srl
ca-key.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
ca-req.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
ca.c fix memory leak in ca 2016-04-05 14:06:39 +01:00
CA.pl.in Fix some issues near recent chomp changes. 2016-02-13 02:54:48 -05:00
cert.pem
ciphers.c Use minimum and maximum protocol version instead of version fixed methods 2016-03-09 19:38:56 +01:00
client.pem
cms.c Remove unused parameters from internal functions 2016-02-22 13:39:44 -05:00
crl2p7.c argv was set but unused 2016-02-20 14:53:53 +01:00
crl.c argv was set but unused 2016-02-20 14:53:53 +01:00
ct_log_list.cnf Extends s_client to allow a basic CT policy to be enabled 2016-03-04 10:50:10 -05:00
dgst.c Remove unused parameters from internal functions 2016-02-22 13:39:44 -05:00
dh1024.pem
dh2048.pem
dh4096.pem
dhparam.c Fix no-dsa 2016-03-21 14:28:56 +00:00
dsa512.pem
dsa1024.pem
dsa-ca.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
dsa-pca.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
dsa.c Make DSA_METHOD opaque 2016-04-03 00:23:56 +01:00
dsap.pem
dsaparam.c Fix mixed declarations and code 2016-04-03 21:49:24 -04:00
ec.c argv was set but unused 2016-02-20 14:53:53 +01:00
ecparam.c argv was set but unused 2016-02-20 14:53:53 +01:00
enc.c Fix "no-ui" configuration 2016-03-31 13:32:01 +02:00
engine.c Use NON_EMPTY_TRANSLATION_UNIT, consistently. 2016-02-09 20:13:29 -05:00
errstr.c Fix errstr error code parsing 2016-02-11 08:53:11 +00:00
gendsa.c Make DSA_METHOD opaque 2016-04-03 00:23:56 +01:00
genpkey.c GH715: ENGINE_finish can take NULL 2016-02-25 15:19:42 -05:00
genrsa.c Make the RSA structure opaque 2016-04-06 16:19:17 +02:00
Makefile.in apps/Makefile.in: add tsget rule. 2016-04-03 17:13:47 -04:00
nseq.c argv was set but unused 2016-02-20 14:53:53 +01:00
ocsp.c Fix no-ocsp 2016-04-06 14:57:45 +01:00
openssl-vms.cnf Remove outdated legacy crypto options 2016-01-27 19:05:50 -05:00
openssl.c Force argv to be an array of long pointers on VMS 2016-04-01 16:23:35 +02:00
openssl.cnf Use better defaults for TSA. 2015-11-20 13:40:53 +00:00
opt.c After saving errno clear it before calls to strtol et. al. 2016-04-03 15:36:17 -04:00
passwd.c Fix "no-ui" configuration 2016-03-31 13:32:01 +02:00
pca-cert.srl
pca-key.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
pca-req.pem Fix verify(1) to report failure when verification fails 2016-01-13 17:55:17 -05:00
pkcs7.c argv was set but unused 2016-02-20 14:53:53 +01:00
pkcs8.c Fix "no-ui" configuration 2016-03-31 13:32:01 +02:00
pkcs12.c Fix "no-ui" configuration 2016-03-31 13:32:01 +02:00
pkey.c argv was set but unused 2016-02-20 14:53:53 +01:00
pkeyparam.c argv was set but unused 2016-02-20 14:53:53 +01:00
pkeyutl.c Add KDF support to pkeyutl. Update documentation. 2016-03-03 16:07:25 +00:00
prime.c Fix "primarility" typo 2015-11-21 14:37:24 +01:00
privkey.pem
progs.h Fix no-gost 2016-03-21 16:28:40 +00:00
progs.pl Fix no-gost 2016-03-21 16:28:40 +00:00
rand.c RT4227: Range-check in apps. 2016-01-12 01:00:31 -05:00
rehash.c Rename some BUF_xxx to OPENSSL_xxx 2015-12-16 16:14:49 -05:00
req.c Make the RSA structure opaque 2016-04-06 16:19:17 +02:00
req.pem
rsa8192.pem
rsa.c Make the RSA structure opaque 2016-04-06 16:19:17 +02:00
rsautl.c Remove unused parameters from internal functions 2016-02-22 13:39:44 -05:00
s512-key.pem
s512-req.pem
s1024key.pem
s1024req.pem
s_apps.h Remove Netware and OS/2 2016-03-17 17:06:57 -04:00
s_cb.c Fix no-sock 2016-03-21 16:33:59 +00:00
s_client.c Suppress CT callback as appropriate 2016-04-07 14:41:34 -04:00
s_server.c Fix no-ocsp 2016-04-06 14:57:45 +01:00
s_socket.c Fix no-sock 2016-03-21 16:33:59 +00:00
s_time.c Fix no-sock 2016-03-21 16:33:59 +00:00
server2.pem
server.pem
server.srl
sess_id.c argv was set but unused 2016-02-20 14:53:53 +01:00
smime.c Remove unused parameters from internal functions 2016-02-22 13:39:44 -05:00
speed.c Add a check of the FD_SETSIZE before the call to select() 2016-04-06 09:09:51 +01:00
spkac.c argv was set but unused 2016-02-20 14:53:53 +01:00
srp.c Use NON_EMPTY_TRANSLATION_UNIT, consistently. 2016-02-09 20:13:29 -05:00
testCA.pem
testdsa.h Make the DSA structure opaque 2016-04-03 00:23:56 +01:00
testrsa.h Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
timeouts.h Remove /* foo.c */ comments 2016-01-26 16:40:43 -05:00
ts.c Fix no-ts with --strict-warnings 2016-03-21 16:35:58 +00:00
tsget.in Make the use of perl more consistent 2016-04-01 07:24:04 +02:00
verify.c Remove unused parameters from internal functions 2016-02-22 13:39:44 -05:00
version.c Have 'openssl version -a' output the default engines directory as well 2016-03-17 07:11:56 +01:00
vms_decc_init.c Force argv to be an array of long pointers on VMS 2016-04-01 16:23:35 +02:00
winrand.c
x509.c Make the RSA structure opaque 2016-04-06 16:19:17 +02:00