58f6d1138a
Properly propagate panics
2016-10-21 21:52:02 -07:00
9be0aab9ac
Borrow compression string
2016-10-21 21:46:32 -07:00
f1c68e3544
Rename SslContextOptions
2016-10-21 21:22:05 -07:00
8ec53eb0e1
Fix X509StoreContext
2016-10-21 20:59:07 -07:00
6f1a3f2834
Update BigNumRef
2016-10-21 20:26:53 -07:00
02b4385c5d
Convert X509VerifyParamRef
2016-10-21 19:58:06 -07:00
f0cde38929
Borrowed servername
2016-10-21 19:54:30 -07:00
fcb86b8394
Convert SslCipherRef
2016-10-21 19:45:46 -07:00
2bbeddd14a
Convert SslRef
2016-10-21 19:33:56 -07:00
fe98a90719
Convert SslContextRef
2016-10-21 19:15:09 -07:00
b7017a7eec
Update Asn1TimeRef
2016-10-21 17:13:30 -07:00
23fc6c828b
Convert X509Ref
2016-10-21 17:01:13 -07:00
b3eb8d516c
Switch X509Name over to new borrow setup
...
The use of actual references enables us to be correct with respect to
mutability without needing two structs for the mutable and immutable
cases and more deref impls.
2016-10-20 22:51:10 -07:00
bd0c0c60bd
Store a MidHandshakeSslStream in fatal errors
...
This in particular allows the X509 verification error to be retrieved,
as well as the stream itself.
2016-10-20 20:57:53 -07:00
8f3511c0cd
Redo SslStream construction
...
SslStream is now constructed via methods on Ssl. You realistically want
to create an Ssl for SNI and hostname verification so making it harder
to construct a stream directly from an SslContext is a good thing.
2016-10-20 19:59:09 -07:00
5ab037f056
Allow the X509 verify error to be read from an SslRef
2016-10-18 22:21:06 -07:00
cfd5192a7d
De-enumify X509ValidationError
...
Also make it an Error.
Closes #352 .
2016-10-18 22:10:37 -07:00
080050e10d
Drop lifetime on GeneralNames
2016-10-18 21:52:49 -07:00
c4459c37d9
Callback cleanup
2016-10-18 21:13:13 -07:00
f7e6d7fce6
Don't ignore errors in NPN/ALPN logic
...
Closes #479
2016-10-18 21:12:55 -07:00
194298a057
Implement new feature setup
...
The basic idea here is that there is a feature for each supported
OpenSSL version. Enabling multiple features represents support for
multiple OpenSSL versions, but it's then up to you to check which
version you link against (probably by depending on openssl-sys and
making a build script similar to what openssl does).
2016-10-17 21:57:54 -07:00
a938a001a7
Fix missing import
2016-10-16 23:26:38 -07:00
b7400d56e8
Fix algorithm field
2016-10-16 23:22:00 -07:00
68954cfc51
Finish BN overhaul
2016-10-16 23:13:00 -07:00
7ec015325b
Finish error overhaul
2016-10-16 21:07:17 -07:00
78daed2d58
ssl error handling cleanup
2016-10-16 20:14:04 -07:00
89a366d9f7
Finish crypto error cleanup
2016-10-16 19:24:04 -07:00
19440c2981
More error cleanup
...
Also allocation free RSA
2016-10-16 19:06:02 -07:00
73ccfe7a29
Continue error handling cleanup
...
Also overhaul/clean up pkcs5 internals
2016-10-16 16:42:56 -07:00
8f89f0bfa9
Start on error + BN refactor
2016-10-16 15:54:09 -07:00
6ea551dc82
Fix set_read_ahead signature
2016-10-15 16:53:10 -07:00
4ba5292a0a
De-enumify Padding
2016-10-15 16:19:19 -07:00
ee18988584
De-enumify SslMethod
2016-10-15 16:10:03 -07:00
1cecaeb62d
De-enumify Cipher
2016-10-15 15:47:40 -07:00
c171be551a
De-enumify message digests
2016-10-15 15:23:29 -07:00
6609a81685
Migrate DSA sign/verify to EVP APIs
2016-10-15 15:02:02 -07:00
228b8fbc5b
Correctly bind BIO_new_mem_buf
2016-10-15 13:39:47 -07:00
4ed81d6426
Fix EVP_DigestVerifyFinal version support
2016-10-15 13:12:37 -07:00
2ff82649b5
Add examples to crypto::sign
2016-10-15 12:50:03 -07:00
ea8cbbe9dc
Fix typo
2016-10-15 12:31:30 -07:00
4d567358a1
Distinguish between verification errors and "other" errors.
2016-10-15 12:31:06 -07:00
bb23b33829
Fix signature of EVP_DigestVerifyFinal on 1.0.1
2016-10-15 12:24:20 -07:00
6ae472487f
Support HMAC PKeys and remove hmac module
2016-10-15 11:06:11 -07:00
cce1d44f28
Remove old RSA sign and verify methods
2016-10-15 10:43:19 -07:00
f73313d688
Signature and verification support
2016-10-15 10:36:59 -07:00
64b8e5e553
Merge pull request #471 from sfackler/no-comp
...
Handle OPENSSL_NO_COMP
2016-10-14 23:09:11 -07:00
e1d1006fad
Check feature compatibility in build script
2016-10-14 23:03:44 -07:00
984b9a0cc7
Don't run test on ARM
...
They're very segfaulty, but it's almost certainly due to the QEMU layer.
We really just want to make sure things compile.
2016-10-14 22:28:24 -07:00
7ac0599638
Fix test_alpn_server_select_none
...
In OpenSSL 1.1, a failure to negotiate a protocol is a fatal error, so
fork that test. This also popped up an issue where we assumed all errors
had library, function, and reason strings which is not necessarily the
case.
While we're in here, adjust the Display impl to match what OpenSSL
prints out.
Closes #465
2016-10-14 22:01:21 -07:00
f520aa2860
Handle OPENSSL_NO_COMP
...
Closes #459
2016-10-14 20:50:45 -07:00
d976b8f595
Enable hostname verification on 1.0.2
2016-10-14 18:56:15 -07:00
af51b263b1
Support hostname verification
...
Closes #206
2016-10-14 17:39:31 -07:00
ae282a78e2
Remove link_name usage
2016-10-14 16:15:50 -07:00
0908fddc74
Ignore DTLS tests on Windows/ARM for now
...
cc #467
2016-10-14 11:15:22 -07:00
f44cff29e6
Cleanup
2016-10-13 22:34:39 -07:00
3d535f661f
Use stdlib logic for udp
2016-10-13 20:15:26 -07:00
a09f46266d
Fix windows for real
2016-10-13 20:09:43 -07:00
5b29fc9d69
Disable npn tests on < 1.0.2
...
s_client doesn't seem to support the required flag before then.
2016-10-13 20:03:02 -07:00
140ef1b988
Fix tests on windows
2016-10-13 20:01:31 -07:00
143556078b
Reenable dtls tests
2016-10-13 19:48:30 -07:00
edfc50f37d
Clean up features
2016-10-13 19:46:13 -07:00
1883590c61
Correct feature selection in tests
2016-10-13 19:21:12 -07:00
b610e01793
Flag off dtls and mask ssl_ops
...
Also un-feature gate npn as it ships with 1.0.1
2016-10-13 19:06:53 -07:00
ce4d233d38
Tweak some comments in Cargo.toml
2016-10-12 22:53:03 -07:00
715b700aff
Ignore a test on OpenSSL 1.1.0
2016-10-12 22:51:47 -07:00
af3e06d3e8
Add remaining SSL_OP constants
2016-10-12 22:50:08 -07:00
43c951f743
Add support for OpenSSL 1.1.0
...
This commit is relatively major refactoring of the `openssl-sys` crate as well
as the `openssl` crate itself. The end goal here was to support OpenSSL 1.1.0,
and lots of other various tweaks happened along the way. The major new features
are:
* OpenSSL 1.1.0 is supported
* OpenSSL 0.9.8 is no longer supported (aka all OSX users by default)
* All FFI bindings are verified with the `ctest` crate (same way as the `libc`
crate)
* CI matrixes are vastly expanded to include 32/64 of all platforms, more
OpenSSL version coverage, as well as ARM coverage on Linux
* The `c_helpers` module is completely removed along with the `gcc` dependency.
* The `openssl-sys` build script was completely rewritten
* Now uses `OPENSSL_DIR` to find the installation, not include/lib env vars.
* Better error messages for mismatched versions.
* Better error messages for failing to find OpenSSL on a platform (more can be
done here)
* Probing of OpenSSL build-time configuration to inform the API of the `*-sys`
crate.
* Many Cargo features have been removed as they're now enabled by default.
As this is a breaking change to both the `openssl` and `openssl-sys` crates this
will necessitate a major version bump of both. There's still a few more API
questions remaining but let's hash that out on a PR!
Closes #452
2016-10-12 22:49:55 -07:00
c1e41349fb
Rename NoPadding to None
2016-10-07 08:10:01 -07:00
b6719de92e
Rename EncryptionPadding to Padding
2016-10-07 08:09:02 -07:00
50648b7dac
Removed max_size; removed all encrypt/decrypt methods except private/public encrypt/decrypt which take the padding
2016-10-07 10:01:16 +03:00
f16cd5586f
added try_ssl_size, which handles -1 as error and returns the value otherwise; added RSA private_decrypt and public encrypt
...
lift_ssl_size
Added public/private encrypt/decrypt to RSA from the original commit + tests; added try_ssl_returns_size macro to check for -1 in case of SSL functions which return size
2016-10-05 14:39:11 +03:00
c5da7131f5
Make sure private component exists when signing
...
Closes #457
2016-09-29 00:09:31 +02:00
8d95383f32
Release v0.8.3
2016-09-09 09:19:24 -07:00
9a449dbd6e
Fix password callback on ARM
...
Closes #449
2016-09-08 09:35:56 -07:00
5e08ad0085
Implement Clone for openssl::error::ErrorStack
2016-09-01 20:10:02 +02:00
4718a88e04
Release openssl-sys v0.7.17, openssl v0.8.2
2016-08-18 12:59:22 -07:00
cd69343d67
Fix SslContext::add_extra_chain_cert
...
SSL_CTX_add_extra_chain_cert assumes ownership of the certificate, so
the method really needs to take an X509 by value. Work around this by
manually cloning the cert.
This method has been around for over a year but I'm guessing nobody
actually used it since it produces a nice double free into segfault!
2016-08-17 19:30:57 -07:00
80ed1ef8ab
Ignore flickering test on windows
2016-08-16 22:41:36 -07:00
7a653282a9
Get rid of use Asn1TimeRef warning for some builds
2016-08-17 01:23:54 -04:00
06f19cf285
Be explicit regarding Asn1TimeRef lifetimes
2016-08-17 01:23:54 -04:00
90c42fc026
Fix docs
2016-08-17 01:23:54 -04:00
234ce581f9
Add x509_validity feature to travis tests
...
- also update docs for new x509 `not_before`, `not_after`
2016-08-17 01:23:54 -04:00
8fa4059b82
Add test for `"x509_validity"` feature
2016-08-17 01:23:54 -04:00
96b1ef829c
Add `"x509_expiry"` feature flag
...
- fix return of `ASN1_TIME_print`
- assert on null `date`
2016-08-17 01:23:54 -04:00
32a4e2ba50
Introduce `Asn1TimeRef`
2016-08-17 01:23:54 -04:00
f9cd4bff1f
Progress on asn1 expiry
...
- Use MemBio and implement `Display` for Asn1Time
- Tweak doc for asn1 `not_before`, `not_after`
2016-08-17 01:23:54 -04:00
e64d3fcfcc
Fix finicky sha1 stdin format
2016-08-17 00:58:05 -04:00
e60c257019
Improve build script
...
- try and fallback to a mirror when openssl.org is down
- check the sha1 of the downloaded tarball
2016-08-17 00:48:56 -04:00
629f638f08
Release openssl-sys v0.7.16, openssl v0.8.1
2016-08-15 18:44:57 -07:00
88dcb1c81d
Add a little comment to sketchy transmute
2016-08-15 18:41:18 -07:00
e6c4135c53
Docs for pkcs12
2016-08-14 11:24:18 -07:00
e5299fd7c9
Fix memory leak in general name stack
2016-08-14 11:16:53 -07:00
6b12a0cdde
PKCS #12 support
2016-08-14 11:11:26 -07:00
ad4a8cc140
More test fixes
2016-08-14 11:05:53 -07:00
3876332734
Fix tests
2016-08-14 10:29:55 -07:00
773a6f0735
Start on PKCS #12 support
2016-08-14 10:11:38 -07:00
5042d3d170
Mangle c helper functions
...
We want to make sure that multiple openssl versions can coexist in the
same dependency tree.
Closes #438
2016-08-13 12:05:29 -07:00
2e8f19ca2f
Release openssl-sys v0.7.15, openssl v0.8.0
2016-08-11 21:00:43 -07:00
63239bf3ee
Require bitflags 7
2016-08-11 20:52:43 -07:00
b21805f541
Fix tests
2016-08-10 22:10:32 -07:00
0359afb99e
Little tweaks
2016-08-10 22:02:36 -07:00
9a3fa4d98d
Fix build
2016-08-10 21:37:24 -07:00
59fe901357
Method renames
2016-08-10 21:28:17 -07:00
c15642ccea
Tweaks
2016-08-10 21:25:18 -07:00
5e6b8e68fd
More API cleanup
2016-08-10 21:07:41 -07:00
c4e7743c57
Asn1 and Bignum renames
2016-08-10 20:51:06 -07:00
35c79d1768
Fix build
2016-08-09 23:13:56 -07:00
00db0bc4b3
Test hmac features
2016-08-09 22:56:08 -07:00
67b5b4d814
Make hmac support optional and remove openssl-sys-extras
...
rust-openssl no longer requires headers for the default feature set.
2016-08-09 22:52:12 -07:00
966c5385ea
Fix build
2016-08-09 22:26:18 -07:00
1ac54b06e9
Move X509_get_extensions to openssl helpers
2016-08-09 22:15:16 -07:00
0854632ff5
Make c_helpers optional
2016-08-09 22:02:49 -07:00
2f46c793e5
Remove rust_SSL_clone
2016-08-09 21:23:54 -07:00
15e8997052
Docs for Crypter::new
2016-08-08 23:31:25 -07:00
b8712c5c51
Fix size check
...
Decryption requires an extra byte of space
2016-08-08 23:25:06 -07:00
a8224d199b
symm reform
2016-08-08 23:10:03 -07:00
522447378e
Copy over getter macros
2016-08-08 20:37:48 -07:00
bf07dd9a4e
Remove symm_internal
2016-08-08 20:26:04 -07:00
e4b97921a9
Clean up RSA and DSA accessors
2016-08-08 19:04:30 -07:00
deb94a904b
Fix build on 1.9
2016-08-07 22:58:20 -07:00
6b1016c86e
Add PKey::from_rsa
2016-08-07 22:56:44 -07:00
6e5cd7ef47
Remove X509Generator::bitlenth
2016-08-07 22:46:14 -07:00
a8f827d28c
Fix example
2016-08-07 22:44:42 -07:00
1968956536
Restore disabled tests
2016-08-07 22:40:51 -07:00
2a3e9a2856
Add RSA::generate
2016-08-07 22:35:37 -07:00
25752280ae
Move init to crate root
2016-08-07 22:09:19 -07:00
77ba043acf
x509 cleanup
2016-08-07 21:53:05 -07:00
79602b6af4
get_error -> error
2016-08-07 21:34:58 -07:00
a0a6c03d74
DH cleanup
2016-08-07 21:19:40 -07:00
4d3c6868e7
pkcs5 reform
2016-08-07 20:57:44 -07:00
7855f428aa
PKey reform
...
This deletes the vast majority of PKey's API, since it was weirdly tied
to RSA and super broken.
2016-08-07 20:38:46 -07:00
7515272692
Fix RSA::verify
...
It never returns -1 - all errors are indicated by 0
2016-08-07 18:03:13 -07:00
6091c674c9
Fix bn tests on 32 bit
2016-08-07 17:52:13 -07:00
b56908a392
Take a c_ulong directly in BN construction
...
Closes #416
2016-08-07 17:48:18 -07:00
7ca5ccf064
Hash reform
...
Closes #430
2016-08-07 16:29:36 -07:00
05089bacb3
Refactor BigNum
2016-08-07 14:33:18 -07:00
5af01a5dbd
Clean up asn1time
2016-08-06 22:23:03 -07:00
bc97d088b0
get_handle -> handle
2016-08-05 21:07:17 -07:00
fe47e93f2f
Fix pkey method safety
2016-08-05 21:04:40 -07:00
b4145c6fa5
Clean up x509
2016-08-05 20:55:05 -07:00
4e911e7972
Make x509 constructors unsafe
2016-08-05 19:51:59 -07:00
c47be8b14b
Move SSL_CTX_set_ecdh_auto to -sys
2016-08-04 22:52:40 -07:00
ee67ea8ea0
Mvoe SSL_CTX_add_extra_chain_cert to -sys
2016-08-04 22:46:47 -07:00
378b86326c
Move SSL_CTX_set_tmp_dh to -sys
2016-08-04 22:43:24 -07:00
7fb7f4671d
Move SSL_CTX_set_read_ahead to -sys
2016-08-04 22:40:01 -07:00
77dbab2cad
Move SSL_CTX_set_tlsext_servername_callback to -sys
2016-08-04 22:37:39 -07:00
c2a7c5b7f0
Move SSL_set_tlsext_host_name to -sys
2016-08-04 22:28:33 -07:00
b29ea62491
Move BIO macros into -sys
2016-08-04 22:22:55 -07:00
dd16f64f89
Stop once-ing init wrapper
...
The underlying function already once-s itself
2016-08-04 22:15:50 -07:00
17474520bc
Support basic SSL options without C shims
2016-08-04 22:14:18 -07:00
abacc8bb18
Define SSL_CTX_set_mode in openssl-sys
2016-08-02 22:14:44 -07:00
c5b2ede282
Merge remote-tracking branch 'origin/breaks'
2016-08-02 20:52:07 -07:00
08e27f31ed
Restructure PEM input/output methods
...
Dealing with byte buffers directly avoids error handling weirdness and
we were loading it all into memory before anyway.
2016-08-02 20:49:28 -07:00
635bdb45a8
BigNum binary operators with different lifetimes.
2016-08-01 22:23:26 +02:00
92abf49b96
Drop unused feature gate
2016-07-31 16:23:48 -07:00
2574bff52d
Merge pull request #432 from alexcrichton/mid-handshake
...
Add MidHandshakeSslStream
2016-07-31 16:20:10 -07:00
f1b64aa2ee
Fix weird inference issue on 1.9
2016-07-31 16:04:03 -07:00
3539be3366
Add MidHandshakeSslStream
...
Allows recognizing when a stream is still in handshake mode and can gracefully
transition when ready. The blocking usage of the API should still be the same,
just helps nonblocking implementations!
2016-07-31 16:01:06 -07:00
6f40b65d2c
Build against 1.9
2016-07-31 15:55:32 -07:00
e86eb68624
Fix catch_unwind feature and drop feature gate
2016-07-31 15:51:22 -07:00
5cb04db787
Fix build with dtls
2016-07-31 15:35:45 -07:00
f0ffa246b8
Merge remote-tracking branch 'origin/master' into breaks
2016-07-31 15:15:47 -07:00
18c1ded8c7
Revert "Add a new trait based Nid setup"
...
This reverts commit 49db4c84df
2016-07-31 14:41:11 -07:00
df30e9e700
Merge pull request #402 from bbatha/feat/dsa-ffi
...
DSA bindings
2016-07-29 22:35:50 -07:00
67d3067dbf
improve error handling in rsa
2016-07-29 20:01:54 -04:00
a3a602be51
add low level dsa primitives
2016-07-29 19:04:37 -04:00
4eaada2c4b
Merge pull request #427 from onur/save_der
...
Implement save_der for X509 and X509Req
2016-07-29 09:05:51 -07:00
7c082904fc
Implement get_handle for X509Req
2016-07-29 16:30:24 +03:00
39be51943d
add RUST_BACKTRACE=1 to make debugging ci failures easier
2016-07-29 09:23:29 -04:00
5ed77df197
Implement save_der for X509 and X509Req
2016-07-29 12:14:49 +03:00
722a2bd673
Set SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER flag
2016-07-24 20:55:15 +02:00
85f5b8629c
Merge pull request #410 from jonas-schievink/passwd-callbacks
...
Password callbacks
2016-07-03 13:42:57 -04:00
5135fca87f
Release v0.7.14
2016-07-01 18:43:39 -04:00
121169c1f5
Set auto retry
...
SSL_read returns a WANT_READ after a renegotiation by default which ends
up bubbling up as a weird BUG error. Tell OpenSSL to just do the read
again.
2016-07-01 18:31:47 -04:00
f24ab26936
FnMut -> FnOnce, update docs
2016-06-26 19:44:53 +02:00
351bc569a4
Put the test behind the catch_unwind feature
...
And fix an unused variable warning
2016-06-26 18:25:54 +02:00
d176ea1c6e
Add an RSA key decryption test
2016-06-26 18:25:54 +02:00
41b78547ad
Put password callbacks behind a cargo feature
2016-06-26 18:25:54 +02:00
c1b7cd2420
Make the callback take a `&mut [c_char]`
2016-06-26 18:25:54 +02:00
c399c2475d
Add RSA::private_key_from_pem_cb
2016-06-26 18:25:54 +02:00
8119f06ca5
Move into utility module
2016-06-26 18:25:54 +02:00
f0b4a032d5
Try to propagate callback panics
2016-06-26 18:25:54 +02:00
311af7c3be
Add PKey::private_key_from_pem_cb
2016-06-26 18:25:54 +02:00
f134b94729
Document BigNum
2016-06-13 16:56:48 +02:00
f4f6412fcb
Fix a few mutable types for `self` parameters.
2016-06-02 10:25:33 -04:00
f6b612df5f
Release v0.7.13
2016-05-20 15:57:57 -07:00
95051b060d
Release v0.7.12
2016-05-16 23:04:03 -07:00
1b0757409d
Rustfmt
2016-05-16 23:03:13 -07:00
2077449bc8
Clean up RSA signature API
2016-05-16 23:03:13 -07:00
d3230874ae
Merge pull request #393 from nox/bitflags
...
Allow bitflags 0.7
2016-05-15 22:11:47 -07:00
62c29b54c1
Update cert
...
Now with a 10 year expriation
2016-05-15 22:11:10 -07:00
2c2c272e6a
Allow bitflags 0.7
2016-05-15 12:27:49 +02:00
dce59a63c5
Merge pull request #389 from cmsd2/master
...
expose rsa from raw private key and rsa sign and verify
2016-05-06 15:12:19 -07:00
f82a1c4f75
add rsa signature tests
2016-05-05 23:41:55 +01:00
78122a9d68
Release v0.7.11
2016-05-05 13:32:27 -07:00
a5ede6a851
add missing NIDs and use Nid as input to signing
2016-05-04 09:00:05 +01:00
49db4c84df
Add a new trait based Nid setup
2016-05-03 21:15:39 -07:00
356d4a0420
Remove AsRaw{Fd, Socket} impls
...
An SslStream can't really act as a raw socket since you'd skip the whole
TLS layer
2016-05-03 20:24:07 -07:00
f1846bce78
Remove silly internal error enum
2016-05-03 20:24:07 -07:00
00f517d2cd
Drop MaybeSslStream
...
It should be inlined into crates that depend on it.
2016-05-03 20:24:07 -07:00
085b2e6f03
Drop is_dtls methods on SslMethod
2016-05-03 20:24:07 -07:00
f09ca6fee2
Clean up SNI APIs
2016-05-03 20:24:07 -07:00
61f65cd8d6
Move SslContext::set_verify to a closure based API
2016-05-03 20:24:07 -07:00
696b1961ce
Rename getters in line with conventions
2016-05-03 20:24:07 -07:00
a0549c1606
Adjust set_ssl_context API
2016-05-03 20:24:07 -07:00
fa62232649
Error reform
2016-05-03 20:24:07 -07:00
58654bc491
Remove deprecated methods
2016-05-03 20:24:07 -07:00
de47d158c2
Remove NonblockingSslStream
2016-05-03 20:24:07 -07:00
6f410a25b2
take enum instead of ints from openssl header file
2016-05-03 22:17:07 +01:00
6bbb21779b
add constructor for private keys from bignums
2016-05-03 19:46:08 +01:00
b7de627eec
Update openssl version in CI
2016-05-03 08:47:28 -07:00
9b1eb6d94d
Add a version of Ssl::set_verify that doesn't set a callback
2016-05-01 20:45:49 -07:00
c7e68637bb
Merge pull request #388 from frewsxcv/lifetimes
...
Remove unnecessary explicit lifetimes.
2016-05-01 19:20:25 -07:00
487232b52d
Remove unnecessary explicit lifetime.
2016-05-01 21:28:51 -04:00
59c13aea84
Still check UTF validity in dnsname
2016-05-01 18:14:33 -07:00
2cfb25136f
Document SAN APIs and tweak accessor names
2016-05-01 09:09:51 -07:00
87782b22cf
Implement IntoIterator for &GeneralNames
2016-04-30 21:32:29 -07:00
bf7076b785
Implement `iter` method on `GeneralNames`.
2016-05-01 00:02:10 -04:00
7b73003b67
Add X509StoreContext::error_depth
2016-04-30 09:27:50 -07:00
62a7dd10e5
Add Ssl::set_verify
...
It also uses a better, closure based API than the existing callback
methods.
2016-04-30 08:09:12 -07:00
50024ce33b
Ignore default verify paths test on windows
2016-04-29 21:40:16 -07:00
8a5d3ea015
Merge pull request #385 from mbrubeck/bitflags-0.6
...
Upgrade to work with bitflags 0.5 and 0.6
2016-04-29 21:18:03 -07:00
a7bade104c
Merge pull request #381 from chaaz/master
...
Add 1DES symm ciphers (des-cbc, des-ecb, des-cfb, des-ofb)
2016-04-29 21:17:17 -07:00
32722e1850
Add accessors for x509 subject alt names
2016-04-29 21:15:32 -07:00
ee12087743
Upgrade to work with bitflags 0.5 and 0.6
2016-04-29 13:19:39 -07:00
caf9272c85
Start on GeneralName
2016-04-28 22:16:29 -07:00
5682c04469
Remove des_cfb and des_ofb, since they appear on limit platforms
2016-04-19 17:28:19 -06:00
54fc1df712
Release v0.7.10
2016-04-16 20:57:12 -07:00
c60e831cc4
Add docs for set_default_verify_paths
2016-04-16 20:49:46 -07:00
c2e72f6641
Add SslContext::set_default_verify_paths
2016-04-16 20:47:32 -07:00
2062d48dd2
Add 1DES symm ciphers (des-cbc, des-ecb, des-cfb, des-ofb)
...
1DES is well and truly dead for actual sensitive information, (its
keysize is too small for modern purposes), but it can still find use in
backwards compatiblity or educational applications.
2016-04-14 03:44:43 -06:00
b94ea8598c
Update for nightly changes
2016-04-13 19:30:08 -07:00
c48dcde568
Update lazy_static
2016-04-13 19:28:04 -07:00
9511a9bc19
Merge pull request #380 from Yoric/master
...
Resolves #378 - Module version with the version information
2016-04-13 14:45:49 -07:00
0c48f9a0e0
Resolves #378 - Module version with the version information
2016-04-13 23:29:25 +02:00
00282de2a5
Add ability to set session ID context on an SSL context
...
This is necessary to make authentication with client certificates work
without session restarts.
2016-04-13 21:38:23 +02:00
fa5537de81
copy PKey using DER encode and decode
...
test that fields of cloned private and public keys can be accessed
2016-04-10 00:16:31 -04:00
d143203f88
Release v0.7.9
2016-04-06 21:34:20 -07:00
4016edd4de
add EVP_PKEY_copy_parameters to FFI
...
copy EVP_PKEY params in PKey::clone
test that PKey::clone creates a copy
2016-04-06 19:39:50 -04:00
c4b7b85d99
Add safe wrapper BioMethod for ffi::BIO_METHOD
...
Adds a wrapper for ffi::BIO_METHOD located at ssl::bio::BioMethod. This
enables SslStream to be Send without doing an unsafe impl on the ffi
struct.
2016-04-04 16:08:38 -07:00
02f114faae
Cleanup
2016-03-27 13:37:00 -07:00
c4187638a8
Update for nightly changes
2016-03-27 13:29:24 -07:00
6d4bfaa490
Cast correctly c_char raw pointers (fixes build on ARM #363 )
...
Fix error caused by mismatched types while building crate
openssl for Raspberry Pi 2 and other ARM devices.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
2016-03-22 00:16:56 +02:00
e0412850ec
Release v0.7.8
2016-03-18 08:54:12 -07:00
6d043b3700
Allow Rust to infer the type of the argument to SSL_CIPHER_description.
...
This allows the code to compile on Android, where an unsigned char is
expected.
2016-03-18 15:44:47 +01:00
ade90bf004
Clean up BIO name
2016-03-17 22:27:16 -07:00
a9a18cf337
Simplify panic safety logic for new nightly
2016-03-17 22:23:51 -07:00
a569df29f4
Release v0.7.7
2016-03-17 09:04:23 -07:00
3467cf343f
Fix nightly warnings about zero-sized fn pointers
2016-03-11 12:57:56 -08:00
23fd427900
Merge pull request #353 from bluejekyll/master
...
adding functionality to directly get and set RSA public key material
2016-03-05 13:57:53 -08:00
3e5b65b7fa
making from_raw() unsafe
2016-03-05 13:43:14 -08:00
2fe3e48487
Stop testing sslv2 feature on Travis
...
OpenSSL removed support for this entirely in the most recent release.
2016-03-01 11:05:41 -08:00
90ce50730b
Update source URL for new OpenSSL release
2016-03-01 10:02:34 -08:00
1f5800fe2c
Merge pull request #356 from erikjohnston/conninfo
...
Add support for SSL_CIPHER
2016-03-01 09:20:36 -08:00
80ac6e54ac
Make SSLCipher.bits() return a struct.
2016-02-29 21:23:34 +00:00
04cbf049c0
Add SSL_get_version
2016-02-29 20:14:48 +00:00
3fb2c48c98
added public key material to the constructor
2016-02-28 22:05:19 -08:00
b37bbba78f
Bump bitflags to 0.4
2016-02-28 08:28:25 +04:00
6ebe581308
review fixes, keep raw RSA initiallization private
2016-02-23 20:49:21 -08:00
ef95223d26
adding functionality to directly get and set RSA key material
2016-02-17 23:18:42 -08:00
1e9667ea89
Add support for SSL_CIPHER
2016-02-17 22:38:32 +00:00
3df4c479c9
Release v0.7.6
2016-02-10 09:36:00 -08:00
643a4a58c9
More deprecated function cleanup
2016-02-08 23:20:19 -08:00
e3e4aa4472
Stop using deprecated method
2016-02-08 23:12:54 -08:00
fe0f8ea1d8
Rename Nid uid/UID to prevent breakage
2016-02-02 14:32:57 -08:00
4940ca7e92
Fix Nid::UID value
...
Nid::UID (userId) previously held the value of Nid::uid
(uniqueIdentifier).
2016-02-02 09:25:52 -08:00
627f394d59
Revert "Revert "impl Clone for PKey and X509 by using their 'references' member""
2016-01-31 20:38:36 +00:00
4e58fd10de
Fix PKey RSA constructors
...
`set1` functions bump the object's refcount so we were previously
leaking the RSA object. Split the decode from PEM part out to a method
on RSA and use that in the PKey constructors.
Also make RSA a pointer and actually free it.
2016-01-30 13:12:06 -08:00
8ab4b54541
Revert "impl Clone for PKey and X509 by using their 'references' member"
2016-01-28 23:37:27 -08:00
274715fad0
Merge pull request #343 from jimmycuadra/ordered-extensions
...
Preserve X.509 extension insertion order
2016-01-28 22:37:48 -08:00
87f94c832f
Bump openssl version to test with
2016-01-28 22:21:10 -08:00
5e0830286e
Preserve X.509 extension insertion order.
...
Ensures that extensions that are order-dependent are inserted in the
same order when calling out to OpenSSL during certificate signing.
Fixes #327 .
2016-01-28 20:02:44 -08:00
7610804c9d
Remove unwraps from rsa accessors
2016-01-22 19:10:22 -08:00
18e7e2455c
Merge pull request #330 from esclear/master
...
Add a interface to RSA structs
2016-01-22 19:07:38 -08:00
d25858cb57
Exclude test directory from package
2016-01-22 16:34:31 -08:00
2ece5b1039
Release v0.7.5
2016-01-22 15:57:21 -08:00
b7d3357f37
Fix connect and accept error reporting
...
We were previously trying to create an error twice so the second
wouldn't be correct.
2016-01-22 15:34:31 -08:00
3ee2bf9310
Fix up RSA integration
2016-01-20 20:29:06 +00:00
74db7db560
Merge branch 'master' of https://github.com/sfackler/rust-openssl
2016-01-20 19:59:41 +00:00
95a83c477c
Merge pull request #334 from jmesmon/ssl-context
...
ssl: fix refcounting of SslContext when set_ssl_context is used
2016-01-19 20:04:44 -08:00
36a667be49
x509: impl Clone using references & CRYPTO_add()
2016-01-19 22:04:51 -05:00
3c51f159a7
crypto/pkey: impl Clone for PKey using openssl's ref counting
2016-01-19 22:04:51 -05:00
d1825c7a86
openssl/ssl/context: test that we are refcounting correctly
...
Not a perfect test, on failure it _might_ exit with this output:
Process didn't exit successfully:
`/home/cody/g/rust-openssl/openssl/target/debug/openssl-8e712036e3aac4fe`
(signal: 11)
But unclear if we can do any better.
2016-01-18 16:40:14 -05:00
dacde211c3
ssl: fix refcounting of SslContext when set_ssl_context is used
...
Additionally impl Clone for SslContext to both allow us to use it &
allow external users to take advantage of SslContext's internal
refcount.
Maintain the existing signature for set_ssl_context(), but
add inline comments recommending changing it.
Fixes #333
2016-01-18 15:37:13 -05:00
1f45723b39
Fix incorrect unsafe declaration
2016-01-12 20:57:01 +00:00
7e8df9febd
Adhere to rust conventions
2016-01-12 18:15:07 +00:00
86e2f81f43
Fix should_panic check
2016-01-11 23:45:12 -08:00
1865dd7374
Test nightly on travis
2016-01-11 22:38:06 -08:00
fd6454f625
Add stream panic propagation behind a nightly feature gate
2016-01-11 22:36:58 -08:00
1238405637
Make the BigNum generation from a native pointer unsafe
2016-01-09 22:09:38 +00:00
b32a50797c
Merge pull request #328 from Cyberunner23/PemRSA
...
Add support for RSA PEM files.
2016-01-09 13:08:00 -08:00
c0b9a4c8ec
Added tests for private_rsa_key_from_pem() and public_rsa_key_from_pem()
2016-01-09 14:36:01 -05:00
89e88727ff
Mark PKey as `Send` and `Sync`
...
Provided that the locking function is set, the underlying `ffi::EVP_KEY`
type should be safe to use across threads.
2016-01-07 06:33:25 +01:00
1d3277fbee
Added private_rsa_key_from_pem and public_rsa_key_from_pem.
2016-01-05 13:22:56 -05:00
578fac7e80
Add public interface to access BigNums from RSA keys
2016-01-01 19:46:03 +00:00
5e5d24ee25
Implement the possibility to create BigNums from their ffi counterpart
2016-01-01 19:36:29 +00:00
5813ca371d
Add RSA structs
2016-01-01 19:33:49 +00:00
926c8167be
Release v0.7.4
2015-12-18 22:41:46 -08:00
11129aa521
Rustfmt
2015-12-18 22:34:30 -08:00
a31acdbb93
Fix deprecation location
2015-12-18 22:21:23 -08:00
e85b49d375
Work around the worst of clone bogusness
...
SslStream::{clone,try_clone} are inherently broken since the Ssl object
shared by both streams is only going to be talking to one stream. Stuff
like hyper depends on try_clone, so we'll leave it here for now but
minimize the brokenness to "no worse than what it used to be like".
They'll be removed in 0.8.
cc #325
2015-12-18 21:20:47 -08:00
5fa46d428d
Release v0.7.3
2015-12-17 21:25:48 -08:00
e077ed0b4d
Disable cross compilation for now
2015-12-17 21:13:44 -08:00
053c924d5a
Fix nonblocking behavior
...
A new nonblocking socket may not have finished connecting yet, so reads
and writes can return ENOTCONNECTED which we should reinterpret into a
WantRead or WantWrite
Closes #323
2015-12-17 16:54:11 -08:00
ccab187f5a
Travis fixes
2015-12-16 23:51:19 -08:00
2cf65fc68d
Stop using manifest-path for now
...
Some ssl tests depend on the working directory being openssl
2015-12-16 23:39:29 -08:00
e7744874f4
Try cross compiling
2015-12-16 23:25:19 -08:00
2531ac9a45
Test overhaul + add an arm cross compile build
...
The ARM build doesn't do anything yet
2015-12-16 22:52:30 -08:00
02d2230a76
Fix regression of c_char type mismatches on ARM
2015-12-16 11:11:14 +01:00
157e6aa961
Rustfmt
2015-12-15 21:51:20 -08:00
edfb318e0b
Fix bounds on ssl_read and ssl_write
2015-12-15 20:06:07 -08:00
13f7cfd9d8
Release v0.7.2
2015-12-15 19:41:57 -08:00
6d559bf1da
Cleanup SNI stuff
2015-12-15 19:39:24 -08:00
3a0e64dca5
Cleanup
2015-12-15 19:33:36 -08:00
167008d247
Merge pull request #320 from uasi/add-variations-of-pbkdf2
...
Add PBKDF2-HMAC-SHA256 and -SHA512 functions
2015-12-15 19:30:57 -08:00
514c5ec415
Merge pull request #309 from Geal/master
...
Add support for Server Name indication (SNI) on the server's side
2015-12-15 19:22:39 -08:00
f2fae1f83f
Document unused variant
...
No reason to hide it
2015-12-14 23:44:28 -08:00
b8c8b770e3
Yet more AsRawSocket fixes
2015-12-12 18:01:21 -08:00
ddedda1d03
More AsRawSocket fixes
2015-12-12 16:47:03 -08:00
63a45ac622
Fix AsRawSocket impls
2015-12-12 16:33:58 -08:00
d6ce9afdf3
Have NonblockingSslStream delegate to SslStream
2015-12-12 15:46:17 -08:00
1df131ff81
Build out a new error type
2015-12-12 15:01:16 -08:00
aa37dba0bc
Make error handling more reliable
2015-12-10 21:58:22 -08:00
b6647cc610
Put pbkdf2_hmac_{256,512}() behind feature gate
...
PKCS5_PBKDF2_HMAC is not available with openssl-0.9.8 on os x
2015-12-10 23:00:49 +09:00
e9b8627af2
Add PBKDF2-HMAC-SHA256 and -SHA512 functions
2015-12-10 20:29:52 +09:00
91f8c542f7
Replace SslStream implementation!
2015-12-09 23:30:29 -08:00
8f56897043
Implement read and write
2015-12-09 22:02:02 -08:00
9ee6f1c578
IT LIVES
2015-12-09 21:43:02 -08:00
4d883d488e
Custom BIO infrastructure
2015-12-08 23:02:38 -08:00
8cc69267fd
Bump openssl version for travis
2015-12-07 19:03:29 -08:00
6850c810d3
Increment SSL_CTX's reference count in Ssl::get_ssl_context()
...
Without this, whenever the returned SslContext is released,
the refcount of the underlying SSL_CTX will decrease and it
will be freed too soon
2015-12-03 12:26:55 +01:00
f54af75eb7
Cast correctly c_char raw pointers (fixes build on ARM #314 )
2015-11-30 21:06:54 +01:00
fce7cf4d36
Release v0.7.1
2015-11-28 16:14:58 -08:00
7835ea1c90
Make shims for SSL_CTX_ctrl and SSL_CTX_callback_ctrl macro wrappers
2015-11-25 08:10:36 +01:00
e486944320
fix memory management
2015-11-25 07:51:22 +01:00
667e3f44b9
Avoid freeing the SSL object when Ssl is dropped
2015-11-24 17:15:52 +01:00
dba3a0ced2
implement get/set ssl context
2015-11-24 17:11:00 +01:00
cb4263f91e
test SNI support
2015-11-24 17:11:00 +01:00
6bb3d8f1b5
Implement try_clone for MaybeSslStream
...
Closes #308
2015-11-20 21:33:36 -08:00
38b3b4a11e
Fixed a typo in a comment.
2015-11-19 19:52:26 -05:00
3c6c4a7b3d
Fix a leak when using `EVP_PKEY_get1_RSA`.
...
`EVP_PKEY_get1_RSA` returns a RSA structure with its reference count
increased by 1 and therefore we need to call `RSA_free` after finishing
using that value.
2015-11-18 11:36:34 +08:00
82547f53d7
Release v0.7.0
2015-11-16 21:10:50 -08:00
1bc96a5b3d
Remove deprecated X509 methods
2015-11-16 20:56:02 -08:00
f36f610d07
Move HMAC_CTX_copy to sys-extras
2015-11-16 20:16:01 -08:00
a8a10e64ad
Split stuff requiring a shim out to a separate crate
2015-11-16 20:16:01 -08:00
8139fadbff
Bump ws2_32-sys version
2015-11-16 20:16:01 -08:00
309b6d9f46
Switch to libc 0.2
2015-11-16 20:16:01 -08:00
03e4908c13
Move SSL methods to Ssl object, add getter
2015-11-16 20:16:01 -08:00
fae44250f6
Fix feature gated sslv3
2015-11-16 20:16:01 -08:00
be2cbabdb7
Revert "Revert "Merge pull request #280 from ltratt/libressl_build""
...
This reverts commit ae3d0e36d7
2015-11-16 20:16:01 -08:00
b0cb0f7c40
Revert "Use AsRef for backwards compatibility with passing IV as Vec"
...
This reverts commit d2d20a8377
2015-11-16 20:16:01 -08:00
65e1d08dd3
Merge pull request #300 from thommay/pkey_private_encrypt
...
Provide public_decrypt, private_encrypt for PKEY
2015-11-16 23:16:04 -05:00
776852ff2b
Travis without sudo
2015-11-08 23:16:42 -08:00
11e3b1b563
Provide public_decrypt, private_encrypt for PKEY
2015-10-28 18:15:55 +00:00
1e7ff1d8a8
Better debug impls
2015-10-26 21:43:52 -07:00
c895b9f09f
Get nonblocking tests working on OSX/Windows
2015-10-22 08:45:29 -07:00
c37767df8f
Nonblocking streams support.
2015-10-20 23:14:26 -07:00
f318a2c84c
Release v0.6.7
2015-10-14 22:25:35 -04:00
ae3d0e36d7
Revert "Merge pull request #280 from ltratt/libressl_build"
...
This reverts commit aad933e50760ee731408
2015-10-14 21:51:32 -04:00
8f5b67fed4
Merge pull request #286 from jedisct1/use_certificate_chain
...
Add set_certificate_chain_file()
2015-10-13 09:26:18 -04:00
81bc1edb61
Merge pull request #284 from bheart/cfb-mode
...
AES CFB-mode feature
2015-10-12 21:18:27 -04:00
a28253ee7d
Add set_certificate_chain_file()
...
SSL_CTX_use_certificate_chain_file() is preferred over
SSL_CTX_use_certificate_file().
It allows the use of complete certificate chains instead of loading
only the first certificate in a PEM file.
2015-10-12 20:54:00 +02:00
acbcb49414
AES CFB{1,8,128} mode support
2015-10-11 20:09:36 +02:00
aad933e507
Merge pull request #280 from ltratt/libressl_build
...
Fix build on LibreSSL.
2015-10-10 21:56:20 -04:00
60ee731408
Merge pull request #277 from nixpulvis/read_public_pem
...
Add public key PEM read function.
2015-10-10 21:55:37 -04:00
677ed6ad1b
Release v0.6.6
2015-10-05 22:34:32 +01:00
d7342a09a7
Fix build on LibreSSL.
...
LibreSSL has deprecated SSLv3_method, so this commit makes that a compile-time
feature.
It also removes a test referencing SSL_OP_CISCO_ANYCONNECT, as the LibreSSL
header says it is amongst "Obsolete flags kept for compatibility. No sane code
should use them."
2015-10-03 17:25:38 +00:59
df93e5e90b
Update documentation about SSLv23
...
In OpenSSL world, the SSLv23 option is a poorly name method that will
negotiate what version of TLS or SSL to use. It starts with the best
version the library supports and then precedes to keep trying all the
way down to SSL 2.0.
2015-10-02 16:22:11 -05:00
ffa9d330fd
Add public key PEM read function.
2015-10-01 20:33:12 -04:00
ccc6d07da3
Add an ecdh_auto description
2015-09-25 15:23:52 +02:00
28320a65a7
Add SSL::set_ecdh_auto()
...
This sets automatic curve selection and enables ECDH support.
Requires LibreSSL or OpenSSL >= 1.0.2, so behind a feature gate.
2015-09-25 13:15:37 +02:00
a91b6bf3bd
Enable testing on Windows via AppVeyor
...
This abolishes the test.sh script which spawns a bunch of `openssl` instances to
instead run/manage the binary in-process (providing more isolation to boot). The
tests have been updated accordingly and the `connected_socket` dependency was
also dropped in favor of `net2` as it the former doesn't work on Windows.
2015-09-22 17:37:21 -07:00
b1b76f7913
Merge pull request #266 from jmesmon/alpn
...
ssl/npn+alpn: adjust protocol selection to fail if no protocols match
2015-09-16 11:51:45 -07:00
4c28eb706e
ssl/alpn: test mismatch between protocols resulting in None
2015-09-16 13:35:12 -04:00
1c3f04138f
Merge pull request #261 from jedisct1/try_ssl_null
...
Use try_ssl_null!() when relevant
2015-09-16 01:13:24 -04:00
6a2b4402e9
Use try_ssl_null!() when relevant
2015-09-13 12:45:05 +02:00
6666a1818a
Add DH::from_pem() to load DH parameters from a file
2015-09-13 12:44:50 +02:00
f4bf55faa3
Merge pull request #270 from mvdnes/crypto_segv
...
Check if public/private RSA key is properly loaded
2015-09-11 11:31:15 -04:00
87d5c0e429
Fix one call to RSA_size found by tests
2015-09-11 09:24:24 +02:00
3be32528e5
Add tests to ensure a panic occurs instead of segv
2015-09-11 09:23:51 +02:00
0eb2f0ecfa
Check rsa.is_null() before passing it to RSA_size
...
RSA_size will cause an segmentation fault if it is null
2015-09-10 13:04:25 +02:00
02b109bf04
Check _fromstr function for success
2015-09-10 12:58:40 +02:00
4781a3304a
Make the docs say that load_pub/save_pub methods take DER bytes
2015-09-09 19:58:45 -04:00
50c5042c70
ssl/npn+alpn: adjust protocol selection to fail if no protocols match
...
The current behavior causes a server written using rust-openssl to (if
it cannot negotiate a protocol) fallback to the first protocol it has
avaliable.
This makes it impossible to detect protocol mismatches.
This updates our selection to be more similar to how openssl's
s_server behaves: non-matching protocols are not supplied with a
fallback.
Note that some setups may actually want a fallback protocol supplied
via ALPN. To support those cases, we should consider adding a generic
callback that allows protocol selection to be entirely controlled by
the programmer.
For the purposes of having a sane default, however, not supplying a
default (and mimicing s_server's behavior) is the best choice.
2015-09-01 17:14:04 -04:00
164f3f0873
openssl/ssl: fix some of the comment text where I missed replacing NPN with ALPN
2015-09-01 17:13:39 -04:00
e28b73e1f6
Merge pull request #259 from jedisct1/dh
...
Add support for DHE for forward secrecy
2015-09-01 00:10:03 -04:00
7b0b70bd13
Release v0.6.5
2015-08-31 19:10:27 -07:00
9add4e1001
Add support for set_tmp_dh() and RFC5114 DH parameters for forward secrecy.
...
rust-openssl didn't support forward secrecy at all.
This adds support for DHE, by exposing set_tmp_dh() as well as the RFC5114
parameters, which are conveniently exposed since OpenSSL 1.0.2.
With OpenSSL >= 1.0.2, and the rfc5114 feature gate, enabling DHE is as simple
as (here for 2048-bit MODP group with 256-bit prime order subgroup):
use openssl::dh::DH;
let dh = DH::get_2048_256().unwrap();
ctx.set_tmp_dh(dh).unwrap();
With OpenSSL < 1.0.2, DH::from_params() can be used to manually specify the
DH parameters (here for 2048-bit MODP group with 256-bit prime order subgroup):
use openssl::bn::BigNum;
use openssl::dh::DH;
let p = BigNum::from_hex_str("87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597").unwrap();
let g = BigNum::from_hex_str("3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659").unwrap();
let q = BigNum::from_hex_str("8CF83642A709A097B447997640129DA299B1A47D1EB3750BA308B0FE64F5FBD3").unwrap();
let dh = DH::from_params(p, g, q).unwrap();
ctx.set_tmp_dh(dh).unwrap();
2015-08-31 23:12:57 +02:00
dc8cba4822
Merge pull request #251 from ebarnard/evp_bytestokey
...
Expose EVP_BytesToKey
2015-08-23 13:37:55 -04:00
8067565707
Expose EVP_BytesToKey
...
This is based on work by pyrho.
Closes #88
2015-08-23 17:08:18 +07:00
4cb68efd99
Merge pull request #253 from manuels/master
...
Add get_state_string()
2015-08-19 02:31:15 -04:00
3fe3d57976
Add get_state_string()
2015-08-17 19:01:43 +02:00
fa5c4cb5df
Fix openssl source link in tests
2015-08-15 14:37:03 -07:00
769b8312d8
Merge pull request #240 from jethrogb/topic/x509_req_extension
...
Implement certificate extensions for certificate requests
2015-08-15 16:04:42 -04:00
df32e53afa
Grab errno for directstream want errors
2015-08-10 22:29:34 -04:00
69cbd14540
Handle WantWrite and WantRead errors
2015-08-08 12:25:16 -07:00
a10604e15d
Merge pull request #243 from manuels/master
...
Fix probelms with DTLS when no packets are pending.
2015-08-02 22:27:19 -04:00
02dc3eda2f
Merge pull request #242 from awelkie/master
...
Added AES CTR-mode under feature flag.
2015-08-02 22:25:09 -04:00
c7eded31a7
Expose ssl::init
2015-07-26 18:28:25 +02:00
ab7bfad225
Add function to write RSA public key as PEM
2015-07-23 22:30:07 -07:00
3fc8482d36
Make curl follow redirects
2015-07-23 21:51:06 -07:00
a43011d77c
Fix probelms with DTLS when no packets are pending.
...
When using DTLS you might run into the situation where no packets
are pending, so SSL_read returns len=0. On a TLS connection this
means that the connection was closed, but on DTLS it does not
(a DTLS connection cannot be closed in the usual sense).
This commit fixes a bug introduced by c8d23f3
2015-07-18 13:00:34 +02:00
b478c29151
Added AES CTR-mode under feature flag.
2015-07-15 20:45:18 -04:00
90dd54b541
Implement certificate extensions for certificate requests
2015-07-08 13:37:35 -07:00
1e4cba36e8
Add missing C-string conversion, fixing recent build errors
2015-07-08 11:05:18 -07:00
3351d5b807
Merge pull request #227 from jethrogb/topic/x509_name
...
Allow setting of arbitrary X509 names
2015-07-08 10:21:19 -07:00
0cb4368ef8
Merge pull request #221 from jethrogb/topic/ssl_options
...
Several SSL option fixes
2015-07-08 10:20:33 -07:00
e3c562d6a0
Fix/add more X509generator tests
2015-07-08 10:09:40 -07:00
1bcbe8f4bc
Add X509generator.add_names method
2015-07-08 10:09:40 -07:00
f2b0da1de7
Add public add_name method to X509Generator
2015-07-08 10:08:41 -07:00
11bcac01ec
Replace CN field by names vector
2015-07-08 10:06:52 -07:00
3229296105
Merge pull request #233 from jethrogb/topic/x509_extension
...
Allow setting of arbitrary X509 extensions
2015-07-08 03:10:40 -04:00
cc497b4768
Release v0.6.4
2015-07-06 11:09:03 -07:00
f4afe615dd
Unpin the bitflags version.
...
This dependency causes Servo to depend on multiple versions of the bitflags
crate.
2015-07-06 19:47:59 +02:00
aeefa364b7
Decouple C SSL Option bit flags from Rust version
...
The OpenSSL "SSL_OP_*" flags are in constant flux between different OpenSSL
versions. To avoid having to change the Rust definitions, we implement our
own numbering system in Rust, and use an automatically-generated C shim to
convert the bitflags at runtime.
2015-07-01 21:49:11 -07:00
f9a836fae9
tabs to spaces
2015-07-01 00:18:45 -07:00
93eb0cfa2d
Add documentation on X509 Extensions
2015-07-01 00:18:45 -07:00
e9cc8cb121
Add Issuer Alternative Name extension
2015-07-01 00:18:45 -07:00
f4168b1161
Add Subject Alternate Name extension
2015-07-01 00:18:45 -07:00
b46574b635
Add arbitrary X509 extensions by OID string
2015-07-01 00:18:45 -07:00
e367567d00
Add arbitrary X509 extensions by NID
2015-07-01 00:18:45 -07:00
2fa1344367
Add public generic extension interface to X509Generator
...
* Add add_extension and add_extensions functions
* Deprecate set_usage and set_ext_usage
* Change test to use add_extension
2015-07-01 00:18:45 -07:00
53b868697a
Implement arbitrary X509 Extended Key Usage values
2015-07-01 00:18:45 -07:00
8d1abf5156
Implement "extensions" field in X509generator, and change existing extensions to use that
2015-07-01 00:18:45 -07:00
d5a4d48cab
Turn assertions into unwraps such that tests provide useful output on panic.
2015-07-01 00:18:44 -07:00
c4e398d397
Turn "dirty hack" into slightly less dirty hack, with potential to become non-dirty
2015-07-01 00:18:44 -07:00
14a2f5c5e9
Move X509 extensions to seperate module, implement ToString instead of custom AsStr
2015-07-01 00:18:44 -07:00
9074af5bdd
Add a test that checks whether 3 known subject attributes can be retrieved by NID
2015-06-30 23:51:54 -07:00
1d214bce61
Fix NID definitions to match OpenSSL. The previous numbers were introduced incorrectly in #213
2015-06-30 23:34:17 -07:00
a6ff56209d
Revert "Don't build a custom openssl on OSX"
...
This reverts commit 645430602d
2015-06-30 00:07:38 -07:00
61e61bbae4
Fix backcompat method
2015-06-29 22:04:31 -07:00
dfacea1df6
Fix build with alpn feature
2015-06-29 21:58:54 -07:00
01e01e3747
ssl: support ALPN
...
Heavily based on the existing NPN wrapping code. Naming of public
functions is identical to the NPN ones with `s/npn/alpn/` applied to
prevent devs from needing to remember 2 names (and to let my copy the
npn tests and perform the subistution to generate the apln tests).
It might make sense to (at some point) use macros or a trait to cut down
the duplication.
2015-06-29 10:58:45 -04:00
539ae2eebf
ssl/NPN: factor out encoding of the protocol list
...
The intention is to allow the encoding to be reused by the ALPN support
code.
2015-06-29 10:57:44 -04:00
a94ea78d8a
ssl: use a common helper to generate new ex data indexes, switch NPN to a lazyref
...
Rather than having the verification data idx generation and NPN use
there own (similar) impls to generate indexes with destructors, unify
them.
Make NPNs use of indexes more idomatic by storing the index in a
lazyref rather than having a function with static data members.
2015-06-29 10:57:44 -04:00
8fdd0e2ec1
More docs
2015-06-28 11:30:49 -07:00
94b0f26c10
Fix windows build
2015-06-28 10:21:06 -07:00
b1dd46ae6a
Docs
2015-06-28 10:15:33 -07:00
3325e6b474
Make the direct constructors the defaults
2015-06-28 10:06:42 -07:00
797488dd09
Add docs for accept and connect
2015-06-28 00:21:41 -07:00
b1a30ce4ba
Rename new_client to connect and new_server to accept
2015-06-28 00:12:47 -07:00
1373a76ce1
Implement direct IO support
2015-06-28 00:06:14 -07:00
9b235a7b91
Prepare for direct stream support
2015-06-27 22:37:10 -07:00
c722f889c1
Docs tweak
2015-06-27 21:40:55 -07:00
0cff370f1d
Reduce SslStream constructor duplication
2015-06-27 21:40:00 -07:00
a80a77bbb8
Initialize stream buffer
2015-06-27 19:42:13 -07:00
9d0acfe615
Fix set_hostname
...
It was previously failing to null terminate the hostname string (was
anyone actually using this?). Also move the macro expansion to the C
shim.
2015-06-27 19:37:45 -07:00
645430602d
Don't build a custom openssl on OSX
...
I don't believe the bugfix the required this is needed anymore
2015-06-27 15:45:48 -07:00
cb7248d8cb
Import shim'd HMAC stuff with the original name
2015-06-27 15:23:19 -07:00
d0b769c93c
Move macro replicas into C shim
2015-06-27 15:11:11 -07:00
524c1e63aa
Release v0.6.3
2015-06-25 23:22:04 -07:00
212acf0bb8
Add a test for connection negotiation failure
2015-06-25 23:07:25 -07:00
c8d23f37a4
Fix EOF handling in retry wrapper
2015-06-25 22:47:53 -07:00
2c18bc7f52
Remove superfluous vec! usage
2015-06-14 21:56:48 -07:00
d2d20a8377
Use AsRef for backwards compatibility with passing IV as Vec
2015-06-14 21:56:23 -07:00
cbf0cbafbf
Pass symmetric crypto initialization vector as a slice
...
Note: This change is backwards-incompatible. Users will need to add turn their
parameters into references.
2015-06-12 18:38:52 -07:00
7344b2703a
Bump bitflags version
2015-06-02 14:33:10 +05:30
7320c1619f
Correction on sign and verify documentation to be more explicit of right
...
behaviour (no hash done by the functions).
2015-05-30 13:08:45 +02:00
8e180371ec
Merge pull request #219 from jethrogb/topic/x509req
...
Implement limited X509_REQ functionality
2015-05-29 00:01:21 -04:00
ed6f7997a2
Remove superfluous dead_code attribute
2015-05-28 20:47:53 -07:00
c1232f3035
Implement limited X509_REQ functionality
2015-05-28 00:22:14 -07:00
a0cbcf56cf
Clarify which keys are used where
2015-05-27 23:46:02 -07:00
1123c7387e
Fix SslString Debug impl and drop lifetime
2015-05-17 11:22:42 -07:00
6d53a3ed20
Test reading CN from test certificate
2015-05-18 02:41:42 +10:00
e88f1567b4
Add support for reading X509 subject information
2015-05-18 02:41:42 +10:00
e7a5ecc8dd
Add test for get_peer_certificate()
2015-05-16 19:37:31 +10:00
5d9eaf53da
Add accessor for peer_certificate
2015-05-16 19:20:38 +10:00
d723481f77
Fix doc root
2015-05-13 16:31:27 -07:00
8a9aa0c657
Merge pull request #210 from manuels/pending
...
Add SslStream.pending()
2015-05-05 22:57:14 -04:00
fb2822d5c7
Merge pull request #201 from manuels/pkey_cmp
...
Add comparison for PKeys
2015-05-04 10:19:13 -07:00
00c17035ec
Abstract over AsRef<Path>
2015-05-02 13:59:11 -07:00
d044d87c1b
Release v0.6.2
2015-05-01 10:43:54 -07:00
b0bcb44556
Move PKey comparison func to public_eq()
2015-05-01 10:58:15 +02:00
c8fae312ad
Add SslStream.pending()
2015-04-30 20:00:30 +02:00
73617dabfa
Write through to underlying stream for every write call
...
cc #208
2015-04-30 00:18:23 -07:00
bce84a6d53
Release v0.6.1
2015-04-22 15:08:56 -07:00
123d400277
Add comparison for PKeys
2015-04-16 17:14:21 +02:00
7db00b97ba
Add X509::public_key()
2015-04-15 22:59:07 +02:00
8027fff782
Fix nightly build issues
2015-04-15 09:10:22 -07:00
8eb5db45bf
Fix non-dtls tests
2015-04-08 22:12:57 -07:00
c5a16db97e
Fix dtls tests
...
There's a reason static mut is unsafe...
2015-04-08 22:10:13 -07:00
483e0b1f0a
Clean up build infrastructure
2015-04-08 21:52:54 -07:00
6f1e9cf47c
Make connected_socket a dev-dependency
2015-04-06 13:00:12 +02:00
b3eae0e3f6
Adapt code for rust-1.0.0-beta
2015-04-06 12:56:38 +02:00
912cacf4bc
Fix rebase errors
2015-04-06 12:26:10 +02:00
fb98f482e2
Add ability to load private keys from files and use raw keys and certificates for SslContext
...
Conflicts:
openssl/src/crypto/pkey.rs
openssl/src/ssl/tests.rs
2015-04-06 12:25:37 +02:00
3c03dd9535
Add ability to load private keys from files and use raw keys and certificates for SslContext
...
Conflicts:
openssl/src/ssl/tests.rs
2015-04-06 12:25:15 +02:00
114253c55e
Change SslContext::set_read_ahead(c_long) to SslContext::set_read_ahead(u32)
2015-04-06 12:23:11 +02:00
62b19e87e8
Fix preemtively exiting openssl dtls server for tests
2015-04-06 12:23:11 +02:00
362a7dfc93
Debug halteproblem with tests
2015-04-06 12:23:11 +02:00
dbef985e32
Move connected_socket to its own crate and fix SSL_CTX_set_read_ahead()
2015-04-06 12:23:11 +02:00
5788f3bec8
Use latest OpenSSL version in travis tests and more verbose error message in ConnectedSocket
2015-04-06 12:22:51 +02:00
014f59ae60
Fix detect_invalid_ipv4 test on OSX
...
Looks like the invalid IP 254.254.254.254 is fine for OSX
2015-04-06 12:22:51 +02:00
3680763906
Fix OSX related compiler error and correct travis OpenSSL setup
2015-04-06 12:22:51 +02:00
4f2978bbd3
Adjust sin_len/sin6_len for non-linux platforms
...
Fixing errors for platforms you don't own is really annoying ;)
Fixing errors
2015-04-06 12:22:51 +02:00
efbd4eee05
Fix portability issue and typo
2015-04-06 12:22:50 +02:00
8a0e9d6cca
Fix travis test setup for DTLS
2015-04-06 12:22:50 +02:00
664600eadf
Add DTLSv1 and DTLSv1.2 support
2015-04-06 12:22:50 +02:00
5408b641dd
Add connect() support for UDP sockets
2015-04-06 12:14:36 +02:00
51dd12934a
Release v0.6.0
2015-04-05 16:50:37 -07:00
36f264551a
Merge pull request #186 from manuels/set_raw_key
...
Use raw keys and certs in SslContext
2015-04-05 16:45:24 -07:00
ed97463346
Release v0.5.5
2015-04-03 08:44:34 -07:00
7e88d8c277
Fix errors in tests (SslVerifyPeer -> SSL_VERIFY_PEER)
2015-04-03 15:16:38 +02:00
57f046e8ea
Use raw pointers instead of ptr::Unique
2015-04-03 14:42:35 +02:00
e1d65fc2be
Return Result<(),SslError> instead of Option<SslError>
2015-04-03 14:34:24 +02:00
b6c5c113f5
Add SslContext::add_extra_chain_cert()
2015-04-03 14:34:24 +02:00
632d8398cf
Add ability to load private keys from files and use raw keys and certificates for SslContext
2015-04-03 14:34:24 +02:00
b42202b858
Change SslVerifyMode to bitflags and add SSL_VERIFY_FAIL_IF_NO_PEER_CERT
...
SslVerifyMode was changed to bitflags to allow for bitwise operations
like (SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT).
2015-04-03 14:34:24 +02:00
4606687829
Stabilize openssl!
2015-04-02 21:12:05 -07:00
293f1ce5b1
Fixup for beta
...
Add derive(Clone) and don't negate unsigned numbers
2015-04-02 18:14:51 -07:00
f4761bb292
Remove two features
2015-04-02 13:59:55 -07:00
368c0a18ee
Release v0.5.4
2015-04-02 11:17:31 -07:00
19a24b80e9
Fix doctest errors
2015-04-02 11:15:59 -07:00
24b876521b
rustup: changes to io::Error
2015-04-02 11:12:18 -07:00
121a667f9b
Remove a bunch of use of core feature
2015-03-30 23:09:15 -07:00
c101abac6b
Remove unsafe_destructor
2015-03-30 21:24:34 -07:00
a2199e0132
Release v0.5.3
2015-03-29 10:22:09 -07:00
2b1a9a7814
Fix verify data free function
...
Turns out this is called with a null pointer if you never set the data
which didn't end up doing anything until the recent zeroing drop
changes.
Also use a map of indexes since statics in generic functions don't
monomorphize
2015-03-29 10:18:30 -07:00
7c079698fc
Fix error with current rust nightly
2015-03-29 15:19:34 +02:00
2453c0f96c
Fix npn feature
2015-03-25 22:02:14 -07:00
36c90bb205
Fix deprecation warnings
2015-03-25 21:50:21 -07:00
73a5276d47
Release v0.5.2
2015-03-25 11:38:04 -07:00
5a80cc8aae
Update to rust master
2015-03-25 10:51:28 -07:00
f50577909e
openssl: Add tests for server-side NPN
2015-03-23 08:41:15 +01:00
8f05e0452a
openssl: Add tests for client-side NPN
...
An additional `openssl` process is spun up before the tests are ran.
This process has NPN enabled with some default protocols.
2015-03-23 08:41:15 +01:00
be674a28e0
openssl: Advertise NPN protocols for server sockets
...
If a server socket is created with a context on which the
`set_npn_protocols` method has been called, during TLS connection
establishment, the server will advertise the list of protocols given to
the method, in case the client indicates that it supports the NPN TLS
extension.
2015-03-23 08:41:15 +01:00
8931299eab
openssl: Add methods to get the protocol selected by NPN
...
The method is added to the `Ssl` struct, since this is how the native
OpenSSL API works. It is also added to the `SslStream` convenience
struct, since the `Ssl` instance that it wraps is not public and clients
may want to check which protocol is in use on a particular SSL stream.
2015-03-23 08:41:15 +01:00
5689ad9260
openssl: Implement client-side NPN protocol selection
...
After the `set_npn_protocols` method of the `SslContext` struct is
called, any future TLS connections established with this context will
perform NPN negotiation.
The chosen protocol is the one with the highest priority in the
server's protocol list that is also in the client's protocol list.
(This is the default behavior provided by OpenSSL's
`SSL_select_next_proto` function.)
If there is no overlap between the two lists, no error is raised.
2015-03-23 08:41:15 +01:00
83c279013b
openssl: Add method for setting protocols to be used in NPN
...
A new method `set_npn_protocols` is added to the `SslContext` struct,
when the `npn` feature is enabled.
The method takes a list of protocols that are supported by the peer.
These protocols will be used during Next Protocol Negotiation.
The method saves the given list within the extra data of the OpenSSL
Context structure, so that the list can be referred to later on by the
callbacks invoked during TLS connection establishment.
2015-03-23 08:41:15 +01:00
3388a12802
openssl: Add NPN crate feature
2015-03-23 08:14:47 +01:00
20335c4f00
Merge pull request #187 from manuels/x509_sign
...
Add X509Generator::sign()
2015-03-21 13:53:25 -04:00
6373b96924
Add X509Generator::sign()
2015-03-21 18:02:29 +01:00
b406b7c6e6
Fix doc test
2015-03-21 10:00:00 -07:00
ac24bc5422
Fix warnings and build issues
2015-03-20 08:33:42 -07:00
a65b03c89e
Fix warnings
2015-03-10 19:38:44 -07:00
8b8736fb46
Merge pull request #172 from reaperhulk/add-ssl-ctx-set-get-options
...
add support for SSL_CTX_set_options and SSL_CTX_get_options
2015-03-07 08:43:30 -08:00
c3eee3b194
Added try_clone to SslStream for SslStream<TcpStream>.
2015-03-02 16:32:25 -05:00
5154581c32
Release v0.5.0
2015-02-27 19:49:01 -08:00
2789764fe3
Merge branch 'breaks'
...
Conflicts:
openssl/src/lib.rs
2015-02-27 19:47:24 -08:00
14e6b1b530
Silence stability warning
2015-02-26 09:02:16 -08:00
6991cc6a30
Convert to new IO.
2015-02-24 23:01:57 -08:00
1b4a2eef0e
Switch to cargo liblibc
2015-02-24 21:47:30 -08:00
8940bd767b
add support for SSL_CTX_clear_options and use bitflags
2015-02-23 19:39:23 -06:00
06ba41ad47
add support for SSL_CTX_set_options and SSL_CTX_get_options
...
fixes #168
2015-02-22 15:45:00 -06:00
69e371aafd
Remove old attributes
2015-02-21 16:48:32 -08:00
81c057b7b9
Relase v0.4.3
2015-02-20 13:47:02 -08:00
cb0e1688c8
Update depreciated code
2015-02-20 21:04:01 +00:00
00e4941a75
Unique<T> now derefs to *mut T
2015-02-20 20:43:07 +00:00
9ca965231c
Release v0.4.2
2015-02-19 09:14:25 -08:00
6bfc4d986b
Fix warnings
2015-02-19 09:13:22 -08:00
d3e48fa131
Release v0.4.1
2015-02-16 23:29:42 -08:00
4e83bebb4b
Rename method for clarity
2015-02-16 23:28:47 -08:00
e52d02171b
Properly handle errors in write
2015-02-16 22:38:34 -08:00
f0eb8e39e3
Deal with openssl errors in read
...
I'm not sure of a great way to generate this case in a test,
unfortunately.
Closes #157
2015-02-16 22:21:13 -08:00
4350298a52
Release v0.4.0
2015-02-13 23:36:34 -08:00
2fa1571e2e
Remove deprecated functions from openssl-sys
2015-02-13 23:31:00 -08:00
aa5b59f034
Move openssl license to openssl
2015-02-13 23:24:40 -08:00
a87decff0e
Release v0.3.6
2015-02-12 13:23:13 -08:00
fabc1da31e
rustup to current master
2015-02-12 18:25:45 +01:00
64287197a2
Release v0.3.5
2015-02-11 21:31:52 -08:00
af0835a8fd
Releaes v0.3.4
2015-02-11 19:59:23 -08:00
a68a74ff6b
Release v0.3.3
2015-02-09 00:05:48 -08:00
5f6d98adc3
Release v0.3.2
2015-02-08 23:40:11 -08:00
6ef819f971
Fix builds against 0.9.x OpenSSL
...
Namely builds on OSX
2015-02-08 23:31:46 -08:00
0894efc3ff
Fix stuff
2015-02-07 21:48:03 -08:00
6f10585593
Build fixes
2015-02-07 21:39:51 -08:00
ec65b0c67b
Move docs to this repo and auto build
2015-02-07 21:30:05 -08:00
Steven Fackler