summaryrefslogtreecommitdiff
path: root/lib/libssl/ssl.h
AgeCommit message (Collapse)Author
2014-06-13Add support for handling SSL_CIPHER_ALGORITHM2_AEAD ciphers, which areJoel Sing
those that use EVP_AEAD instead ov EVP_CIPHER. This means being able to change cipher state with an EVP_AEAD and being able to encrypt/decrypt TLS using the EVP_AEAD. This has no change on existing non-SSL_CIPHER_ALGORITHM2_AEAD ciphers. Based on Adam Langley's chromium patches. Rides the recent libssl bump. Tested by sthen@
2014-06-13Add an SSL_AEAD_CTX to enable the use of EVP_AEAD with an SSL cipher.Joel Sing
Read and write contexts are also added to the SSL_CTX, along with supporting code. Based on Adam Langley's chromium diffs. Rides the recent SSL library bump.
2014-06-13Remove support for the `opaque PRF input' extension, which draft has expiredMiod Vallat
7 years ago and never made it into an RFC. That code wasn't compiled in anyway unless one would define the actual on-the-wire extension id bytes; crank libssl major. With help and enlightenment from Brendan MacDonell.
2014-06-12tags as requested by miod and teduTheo de Raadt
2014-06-08Factor out the part of tls1_change_cipher_state() that is specific toJoel Sing
switching cipher states using an EVP_CIPHER. This will facilitate the addition of cipher state changes for EVP_AEAD. No functional change. Based on Adam Langley's chromium patches.
2014-06-07http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2016265dfbab162e ↵Theo de Raadt
c30718b5e7480add42598158 Don't know the full story, but it looks like a "can't do random perfectly, so do it god awful" problem was found in 2013, and replaced with "only do it badly if a flag is set". New flags (SSL_MODE_SEND_SERVERHELLO_TIME and SSL_MODE_SEND_SERVERHELLO_TIME) were added [Ben Laurie?] to support the old scheme of "use time_t for first 4 bytes of the random buffer". Nothing uses these flags [ecosystem scan by sthen] Fully discourage use of these flags in the future by removing support & definition of them. The buflen < 4 check is also interesting, because no entropy would be returned. No callers passed such small buffers. ok miod sthen
2014-05-31ECDH and ECDSA will not work overly well if there is no EC, so unifdefJoel Sing
OPENSSL_NO_EC. ok tedu@
2014-05-31TLS would not be entirely functional without extensions, so unifdefJoel Sing
OPENSSL_NO_TLSEXT. ok tedu@
2014-05-30remove some #if 0 code. we don't need any more reminders that we're usingTed Unangst
a not quite appropriate data structure. ok jsing
2014-05-29Everything sane has stdio, and FILE *. we don't need ifdefs for this.Bob Beck
ok to firebomb from tedu@
2014-05-29remove back compat that was already disabled back in 1998.Ted Unangst
from Alexander Schrijver
2014-05-29Any sane platform has stdio. Stop pretending we will ever use a platformBob Beck
that does not. "fire bomb" tedu@
2014-05-29unidef DH, ECDH, and ECDSA. there's no purpose to a libssl without them.Ted Unangst
ok deraadt jsing
2014-05-25The ssl_ciper_get_evp() function is currently overloaded to also return theJoel Sing
compression associated with the SSL session. Based on one of Adam Langley's chromium diffs, factor out the compression handling code into a separate ssl_cipher_get_comp() function. Rewrite the compression handling code to avoid pointless duplication and so that failures are actually returned to and detectable by the caller. ok miod@
2014-05-24Include <openssl/opensslconf.h> - currently ssl.h is relying on it beingJoel Sing
pulled in elsewhere, even though it is makes use of the OPENSSL_NO_* defines. While here, remove kssl.h since it is a no-op. ok beck@ miod@
2014-05-22There are two actual uses of e_os2.h in libssl - an OPENSSL_GLOBAL (anJoel Sing
empty define) and an OPENSSL_EXTERN (which is defined as, well... extern). The use of OPENSSL_EXTERN is already inconsistent since the lines above and below just use plain old "extern". Expand the two uses of these macros and stop including e_os2.h in libssl. ok miod@
2014-05-05Remove SRP and Kerberos support from libssl. These are complex protocolsTed Unangst
all on their own and we can't effectively maintain them without using them, which we don't. If the need arises, the code can be resurrected.
2014-05-02Nuke OPENSSL_NO_SOCK since any half sane operating system has sockets.Joel Sing
ok beck@
2014-04-30i suck at math. b - 8 = 3, not 4. detected by Antoine Pitrou. thanks.Ted Unangst
2014-04-28SSL_OP_ALL is supposed to be all options and workarounds that are safe,Ted Unangst
but disabling attack mitigations is not safe. 0.9.6d contained a workaround for an attack against CBC modes. 0.9.6e disabled it by default because "some" implementations couldn't handle empty fragments. 12 years have passed. Does anybody still care? Let's find out. ok miod
2014-04-28Remove ending cplusplus guard followed by starting cplusplus guard; fromMiod Vallat
Gebruiker Schoot.
2014-04-24Bring back the SSL_OP_PKCS1_CHECK_* defines (defined to zero, as they alreadyMiod Vallat
were), after stumbling upon code (mis)using them in the wild.
2014-04-23Unifdef -UPKCS1_CHECK and remove SSL_OP_PKCS1_CHECK_[12], this is leftoverMiod Vallat
``debug'' code from a 15+ years old bugfix and the SSL_OP_PKCS1_CHECK_* constants have had a value of zero since ages. No production code should use them. ok beck@
2014-04-20Chop off more SSLv2 tentacles and start fixing and noting y2038 issues.Philip Guenther
APIs that pass times as longs will have to change at some point... Bump major on both libcrypto and libssl. ok tedu@
2014-04-19More KNF and style consistency tweaksPhilip Guenther
2014-04-17always build in RSA and DSA. ok deraadt miodTed Unangst
2014-04-16TANSTAAFL - delete the buf freelist code. if you need a better malloc, getTed Unangst
a better malloc. ok beck deraadt
2014-04-16add back SRP. i was being too greedy.Ted Unangst
2014-04-16disentangle SRP code from TLSTed Unangst
2014-04-15remove ssl2 support even more completely.Ted Unangst
in the process, always include ssl3 and tls1, we don't need config options for them. when the time comes to expire ssl3, it will be with an ax. checked by miod
2014-04-15First pass at applying KNF to the OpenSSL code, which almost makes itJoel Sing
readable. This pass is whitespace only and can readily be verified using tr and md5. There is still a huge amount of inconsistency within these headers.
2014-04-14make OPENSSL_NO_HEARTBLEED the default and only option. ok deraadt miodTed Unangst
2014-04-13Cope with the removal of openssl/symhacks.hTheo de Raadt
2014-04-13Flense a variety of windows support stuff, and a strange gettimeofday function.Bob Beck
ok deraadt@
2014-04-13Remove vms support stuff.Bob Beck
ok deraadt@
2014-04-13Merge conflicts; remove MacOS, Netware, OS/2, VMS and Windows build machinery.Miod Vallat
2012-10-13resolve conflictsDamien Miller
2012-01-05OpenSSL 1.0.0f: mergeDamien Miller
2010-10-01resolve conflicts, fix local changesDamien Miller
2009-01-05update to openssl-0.9.8i; tested by several, especially krw@Damien Miller
2008-09-06resolve conflictsDamien Miller
2006-06-27resolve conflictsDamien Miller
2005-04-29resolve conflictsDamien Miller
2004-04-08merge 0.9.7dMarkus Friedl
2003-05-12merge 0.9.7b with local changes; crank majors for libssl/libcryptoMarkus Friedl
2002-09-14merge with openssl-0.9.7-stable-SNAP-20020911,Markus Friedl
new minor for libcrypto (_X509_REQ_print_ex) tested by miod@, pb@
2002-09-10merge openssl-0.9.7-beta3, tested on vax by miod@Markus Friedl
2002-07-30apply patches from OpenSSL Security Advisory [30 July 2002],Markus Friedl
http://marc.theaimsgroup.com/?l=openssl-dev&m=102802395104110&w=2
2002-05-15OpenSSL 0.9.7 stable 2002 05 08 mergeBob Beck
2001-06-22openssl-engine-0.9.6a mergeBob Beck
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-15 06:25:16 +0000