5d8a44612d
add test for psk; deprecated set_psk_callback
2018-06-02 13:47:52 -04:00
b1eb1224f5
Merge remote-tracking branch 'origin/master'
2018-06-02 10:56:31 -04:00
83767b861e
Release openssl v0.10.9
2018-06-01 20:59:26 -07:00
52f581ffc9
Release openssl-sys v0.9.32
2018-06-01 20:57:09 -07:00
a3a2605115
fix build on older rustc
2018-06-01 20:47:46 -07:00
10b2a34529
Adjust Nid signature algorithm APIs
2018-06-01 20:36:19 -07:00
c2145384a9
Fix types
2018-06-01 20:07:13 -07:00
15cb335e66
Fix use-after-free in cms
...
Closes #941
2018-06-01 19:38:52 -07:00
3456add537
Add SslRef::verified_chain
2018-05-29 21:53:22 -07:00
2977f6ed30
rewrite Nid::{long_name,short_name} to return Results instead of Options
2018-05-28 12:15:05 +02:00
b8de619fbe
Get Nid string representations
2018-05-28 12:13:40 +02:00
a774c0c5f2
Rename X509Ref::fingerprint to X509Ref::digest and avoid allocating
2018-05-24 21:07:36 -07:00
772e1c003f
Add some digest support
2018-05-24 21:06:11 -07:00
3cd33cdd8b
Don't panic on bogus servernames
...
Also add a second version of the method to avoid filtering out non-utf8
names.
Closes #930
2018-05-24 20:22:15 -07:00
c0876cc8c6
Add bindings to SSL_get_finished and SSL_get_peer_finished
...
These are used for the tls-unique SCRAM channel binding mode.
2018-05-24 20:00:28 -07:00
c7db3d18ad
Merge pull request #920 from Ralith/max-early-data-accessors
...
TLS1.3 early data support
2018-05-22 20:42:46 -07:00
2e478fdcf4
Expose early I/O
2018-05-22 20:25:28 -07:00
b187eb0ee3
Release openssl v0.10.8
2018-05-20 21:03:16 -07:00
25df3c8b51
Release openssl-sys 0.9.31
2018-05-20 21:02:12 -07:00
7a7f98a32c
Revert "Move proto version accessors to SslContextRef"
2018-05-20 20:55:20 -07:00
b976b5fd52
Move proto version accessors to SslContextRef
...
Add a Derf impl for SslContextBuilder so existing use still works.
2018-05-20 20:47:00 -07:00
f0347fbce8
Improve error Display impls
2018-05-20 19:37:19 -07:00
3ab1cc7a8f
Make Stack Sync + Send
2018-05-20 15:24:38 -07:00
4c1fdf1d81
Support ALPN on libressl
...
Closes #690
2018-05-20 12:52:49 -07:00
a6fcef01c0
Overhaul openssl cfgs
...
Also expose hostname verification on libressl
2018-05-20 12:33:02 -07:00
d991566f2b
Support min/max version in LibreSSL
...
Their implementations of the accessors don't behave expected with no
bounds, so we ignore those bits of the tests.
2018-05-19 19:57:12 -07:00
69c75a178b
Expose early keying material export
2018-05-17 13:16:41 -07:00
d5d414b16f
Expose max TLS1.3 early data accessors
2018-05-17 12:02:32 -07:00
47a68e2929
Add wrapper for SSL_CTX_set_psk_server_callback
2018-05-16 17:49:36 -04:00
53671518fd
Merge pull request #902 from ur0/CMS_sign
...
Add the CMS_sign and i2d_CMS_ContentInfo function bindings
2018-05-13 15:53:49 +01:00
b1e5c8b1ed
Implement Clone for Rsa
...
Closes #917
2018-05-12 16:34:47 -07:00
ff2c7ffefd
Merge Ssl impl blocks
2018-05-12 16:50:50 +01:00
c25b6f3e26
Clean up SSL callbacks
...
Also add an Arc to avoid a weird use after free edge case if a callback
changes a callback.
2018-05-12 15:02:53 +01:00
5cfbe7ac6a
Disable tests that talk to Google on LibreSSL 2.5.0
...
They're flickering, and I'm assuming it's just because that version is
so old.
2018-05-12 13:59:22 +01:00
e5d65306e7
Change SslContext callback handling
...
Use the existing infrastructure!
2018-05-12 13:19:01 +01:00
afaa2387c8
Gate away CMS_KEY_PARAM from OpenSSL 1.0.1
2018-05-10 21:41:59 +05:30
541458c1c1
Properly version-gate CMS constants
2018-05-10 21:20:32 +05:30
90898e99c9
Move CMS_* flags to the openssl-sys package
...
Also renames attributes in the bitflags struct.
2018-05-10 20:26:57 +05:30
7a1b59d605
Fix base version for min/max proto accessors
...
Closes #911
2018-05-09 20:04:43 +01:00
42cbd0111b
Release openssl v0.10.7
2018-04-30 20:41:23 -07:00
25e3f66e3e
Release openssl-sys v0.9.30
2018-04-30 20:40:29 -07:00
47431f66bb
Expose SslSession <-> DER conversion
2018-04-29 01:54:16 -07:00
aa619c81c0
Some misc cleanup
2018-04-27 15:41:12 -07:00
043ad63a52
Use bitflags for CMS options
2018-04-26 09:15:29 +05:30
24ece94e99
Remove Rsa::build
...
It could be a bit confusing since it only works for private keys.
2018-04-25 19:55:35 -07:00
261463542f
Merge pull request #901 from eoger/rsa-from-builder
...
Add RsaPrivateKeyBuilder
2018-04-25 14:51:02 -07:00
9a83e3350b
Add RsaPrivateKeyBuilder
...
Fixes #837
2018-04-25 11:18:57 -04:00
13caf731a2
Implement CR suggestions
...
* Don't do un-necessary heap pointer gymnastics
* Use the to_der! macro instead of a manually written impl
* Allow optional arguments for CMS_sign
2018-04-22 10:57:09 +05:30
5bb89d7552
Add functions to X509Req to obtain public key and extensions
...
This allows for basic CSR signing.
2018-04-21 23:14:48 +02:00
8ce5dee00d
Add the CMS_sign and i2d_CMS_ContentInfo function bindings
...
This adds the CMS_sign and i2d_CMS_ContentInfo bindings in the
openssl-sys crate and Rusty wrappers in the openssl crate.
2018-04-20 17:15:04 +05:30
973a3fede1
Document that encrypt/decrypt use padding
2018-04-16 14:45:56 +01:00
cab98be606
Release openssl v0.10.6
2018-04-05 11:12:06 -07:00
78d91428b5
Release openssl-sys 0.9.28
2018-04-05 11:09:36 -07:00
75bf48368d
Return `PKey<Private>` from `private_key_from_der`
2018-04-04 14:58:52 +02:00
e423da2d12
Merge pull request #858 from Ralith/stateless-api
...
Introduce SslStreamBuilder
2018-03-31 11:28:03 -07:00
5c317d5a35
Remove unneeded build keys
2018-03-30 11:32:57 +02:00
a14b7cc276
Don't enable features for docs anymore
2018-03-29 22:41:40 +02:00
ac950b28aa
Fix a flag name
2018-03-29 10:26:43 +02:00
1bbe1b6a8f
Clean up a couple of holdovers from old features
2018-03-29 10:20:18 +02:00
f99c101559
Add test for stateless connection
2018-03-28 18:14:48 -07:00
99fdb2bd0b
Introduce SslStreamBuilder
2018-03-28 18:14:48 -07:00
bbb1cb61f6
Update to OpenSSL 1.1.1-pre3
2018-03-28 18:14:44 -07:00
c82a87a18e
Add Asn1IntegerRef::to_bn
...
Also deprecate Asn1IntegerRef since it's just asking for trouble.
2018-03-28 20:48:28 +02:00
7890672725
Add X509Ref::serial_number
2018-03-28 20:41:28 +02:00
d49e496940
Remove a last couple features
2018-03-19 20:41:08 +00:00
063186b62e
Merge pull request #856 from Flakebi/master
...
Make it possible to use cmac
2018-03-19 13:22:51 -07:00
0860115156
Make it possible to use cmac
...
This adds Signer::new_without_digest to create Signers which don't have
a digest (like cmac, which is based on aes).
As openssl supports cmac since version 1.1.0, the functions are behind
the ossl110 feature.
This allows building CMAC/OMAC1 and the EAX AEAD on top of this library.
2018-03-19 21:02:46 +01:00
7c33346960
Remove version-specific features
...
Closes #852
2018-03-19 00:41:33 -07:00
cf658e4c5c
Merge pull request #875 from Ralith/hash-extras
...
Expose cipher digests and digest sizes
2018-03-16 22:00:59 -07:00
09b1fe9a0d
Expose additional cipher and digest accessors
2018-03-16 20:33:23 -07:00
66a2ad76b7
Merge pull request #874 from rohit-lshift/priv-key-from-num
...
Added a function to create a EcKey<Private> from its parts
2018-03-13 21:50:17 -07:00
e3a657d22b
Change function name to be similar to RSA one
2018-03-13 08:57:35 +00:00
9452c01672
Merge pull request #864 from mlen/aes-ccm-bindings
...
Implement AES-{128,256}-CCM bindings
2018-03-11 16:30:37 -07:00
170adae336
Merge pull request #873 from sfackler/tweaks
...
Add a Sync + Send bound to the custom ext type
2018-03-11 16:10:54 -07:00
7edecbd3a8
Merge pull request #872 from sfackler/tweaks
...
Some ECDSA fixes/tweaks
2018-03-11 15:37:28 -07:00
9f5ef88880
Add a Sync + Send bound to the custom ext type
...
It's stored inside of the Ssl, so this is probably tecnically
necessarly?
2018-03-11 15:36:47 -07:00
d0329473bd
Merge branch 'master' into custom-extensions
2018-03-11 15:27:28 -07:00
c9ef7f3cd5
Some ECDSA fixes/tweaks
2018-03-11 15:23:23 -07:00
1b830c3fb7
Merge pull request #863 from rohit-lshift/master
...
Exposed some of ECDSA functions
2018-03-11 15:08:16 -07:00
4ee7e0d3a9
Tweak verify_cert's signature
...
The call can fail either due to an invalid cert or an internal error,
and we should distinguish between the two.
2018-03-11 14:08:34 -07:00
cefad46cf5
fixup! Implement AES-{128,256}-CCM bindings
2018-03-11 22:04:01 +01:00
00359a1a55
Merge pull request #861 from bkchr/verify_certificate
...
Implements `X509_verify_cert`
2018-03-11 13:37:21 -07:00
40e59db37c
Rename Oid to Id
2018-03-11 13:29:01 -07:00
d7a7c379a8
Changes `init` to take a closure which is called with the initialized context
...
After calling the closure, we automatically cleanup the context. This is
required, because otherwise we could have dangling references in the context.
2018-03-11 11:34:36 +01:00
c0a4bc4202
Revert previous commit
2018-03-11 07:41:22 +00:00
e02dbde2f7
Generic custom extension add fn return type
2018-03-10 22:30:54 -08:00
eb5fda588f
Merge pull request #862 from bkchr/sign_verifier
...
Adds new functions for Verifier/Signer
2018-03-10 16:42:33 -08:00
562fe79f4c
Add one more set of impls
2018-03-10 08:53:46 -08:00
bc304565e7
Arguments should be BigNumRef and not BigNum
2018-03-10 16:29:54 +00:00
245f5f3a11
Impl Sync and Send for various types
...
Closes #865
2018-03-09 22:14:50 -08:00
b0bc1c770e
High-level API for OpenSSL 1.1.1 custom extension support
2018-03-09 20:33:49 -08:00
7fe3fabf24
Switches to new type wrapper for RsaPssSaltlen
2018-03-10 00:27:15 +01:00
a5d7f8a718
Moves store context init into its own function
2018-03-10 00:15:03 +01:00
e655b561a7
Added a function to create a EC<Key> from its parts
2018-03-09 15:58:56 +00:00
7ab650098c
Remove unneeded paramter
2018-03-09 10:39:58 +00:00
4866e9ff8a
fixup! Implement AES-{128,256}-CCM bindings
2018-03-08 21:57:39 +01:00
8461129456
Changes as per PR feedback
2018-03-08 17:42:15 +00:00
9e2755abae
Get curves for OpenSSL tests itself
2018-03-08 17:10:09 +00:00
0a38b5a9ef
Try out another curve
2018-03-08 16:56:40 +00:00
4b4d312018
Another try at using the correct curve
2018-03-08 16:46:31 +00:00
dcbb45cc9d
Implement AES-{128,256}-CCM bindings
2018-03-08 17:24:55 +01:00
d4de2a408f
Use examples listed in OpenSSL docs for testing
2018-03-08 16:12:35 +00:00
a5ba1a0007
Adds `RsaPssSaltlen` enum to encode the special values
2018-03-08 16:17:32 +01:00
b0ea53184d
Switches to newtype wrapper for Oid
2018-03-08 12:24:37 +01:00
1a0b085377
Extends the test to verify the certificate two times
2018-03-08 12:10:29 +01:00
810ddeb4ca
Moves `cleanup` into its own function
2018-03-08 12:08:39 +01:00
2d6cd9eb16
Exposed some of ECDSA functions
2018-03-08 09:44:05 +00:00
724dd6f830
Adds more functions to `Verifier`/`Signer` for RSA keys
2018-03-07 20:43:28 +01:00
84a5ce7607
Adds RSA PKCS1 PSS padding
2018-03-07 20:43:12 +01:00
9a8a1c752b
Adds `PKeyRef::get_id` to get the OID of a key
2018-03-07 18:42:13 +01:00
888f4ccaab
Fixes the implementation of `X509StoreContextRef::verify_cert`
...
The certificate, the store and the certificates chain does not need to be
consumed by `verify_cert` and instead are taken as references. We also call
`X509_STORE_CTX_cleanup`, after the verification succeeded.
2018-03-07 16:07:57 +01:00
53adf0e6a4
delay return until after forgets
2018-03-07 13:54:35 +01:00
6abac82f13
cleanup and add negative test
2018-03-07 13:54:35 +01:00
a1cfde765a
add cleanup ffi to store context
2018-03-07 13:54:15 +01:00
3187366cc5
restructure to self contained function
2018-03-07 13:53:29 +01:00
2251a6f2b6
Little tweaks
2018-03-07 13:51:58 +01:00
d8a11973e2
convert to raw pass-through methods
2018-03-07 13:51:58 +01:00
910386027d
add comment about consuming self in verify_cert
2018-03-07 13:50:12 +01:00
35cad33d51
fix error check
2018-03-07 13:50:12 +01:00
847fac25f8
properly version library functions
2018-03-07 13:48:09 +01:00
3595ff9e51
Fix memory mgmt
2018-03-07 13:42:39 +01:00
eb6296e892
add verify_cert and store_context_builder
2018-03-07 13:41:44 +01:00
f645165ee2
Remove the x509 module-level example
...
The example generated a bogus certificate that was missing a serial
number, a validity range, etc.
Generating a correct x509 certificate is complex enough that doing it
correctly is too long to be a reasonable doc example. There's already
a more complete example in the examples directory that handles things
more correctly.
Closes #859
2018-03-05 19:25:01 -08:00
f92de22b8d
Add SslOptions::ENABLE_MIDDLEBOX_COMPAT
2018-03-03 14:57:38 -08:00
b6985c7e8d
Release openssl v0.10.5
2018-02-28 14:33:04 -08:00
aa9addf532
Release openssl-sys 0.9.27
2018-02-28 14:31:23 -08:00
85d8db21d2
Always include something in ErrorStack's Display
...
The error stack can be empty after a some kinds of errors (AEAD
validation failure in Crypter is one example), and we don't want to
display as an empty string in that case.
2018-02-27 15:56:23 -08:00
b7ba577339
Add min/max protocol version support
2018-02-25 23:20:10 -08:00
d5dd6575c1
Restore error stack in cookie callback
2018-02-25 22:11:08 -08:00
e04dbfa3ee
Expose cookie generate/verify callback setters
2018-02-25 20:05:15 -08:00
cebfbd9a25
Merge pull request #850 from sfackler/put-error
...
Add the ability to push errors back onto the error stack.
2018-02-24 20:58:07 -08:00
5fd23d38d5
Add the ability to push errors back onto the error stack.
2018-02-24 20:46:03 -08:00
f72f35e9bd
Add RFC 5705 support
2018-02-23 22:04:57 -08:00
7e0591a377
Actually add version stuff
2018-02-21 23:25:28 -08:00
950c39c2e6
Merge pull request #840 from olehermanse/master
...
Add des_ede3_cbc cipher and more tests/examples
2018-02-21 23:03:33 -08:00
15048f4c02
Inline connector constants
2018-02-21 19:41:06 -08:00
6977e9e89f
Don't special case 1.0.1
...
It appears that 1.0.1's defaults are actually okay.
2018-02-21 18:44:04 -08:00
7e02c09861
Added example/test in symm.rs for encrypting a private key with a symmetric cipher
...
Signed-off-by: Ole Herman Schumacher Elgesem <oleherman93@gmail.com>
2018-02-21 13:16:04 +01:00
7192a5291f
Update SslConnector cipher list
...
Based off of python/cpython#3532 , we use OpenSSL's default cipher list
and turn of things we don't like. This can't be used with 1.0.1,
however, which had a poor default set. There, we use the old defaults,
with the bits that aren't implemented in 1.0.1 removed (namely TLSv1.3
suites and ChaCha).
2018-02-20 22:27:54 -08:00
69a91815b8
Release openssl v0.10.4
2018-02-18 10:50:13 -08:00
2daaf3fdea
Add some debugging-related bindings
2018-02-17 17:49:49 -08:00
90d5f85511
Add SSL_version binding
2018-02-17 13:44:21 -08:00
3f5e3f095e
Fix session cloning
2018-02-17 10:12:47 -08:00
e5123d266b
Bind remove and get session callbacks
2018-02-16 22:24:34 -08:00
4dffa0c33f
SSL session callbacks have always been around
2018-02-16 21:31:09 -08:00
8abc51c2b3
Fix symm decrypt documentation example
2018-02-16 11:59:47 +01:00
af4832e145
Doc tweak
2018-02-15 21:33:39 -08:00
a9d8bea33c
Add more session cache support
2018-02-15 21:30:20 -08:00
cc34a7149e
Add des_ede3_cbc cipher
...
Signed-off-by: Ole Herman Schumacher Elgesem <oleherman93@gmail.com>
2018-02-15 17:44:44 +01:00
f4ddd66b03
Tweak features
...
We should keep the version features totally separate for now.
2018-02-14 22:11:24 -08:00
Benjamin Cheng