Commit 5121ce5b authored by Paul Bakker's avatar Paul Bakker

- Renamed include directory to polarssl

parents
= Version 0.9 released on 2008-03-16
* Added support for ciphersuite: SSL_RSA_AES_128_SHA
* Enabled support for large files by default in aescrypt2.c
* Preliminary openssl wrapper contributed by David Barrett
* Fixed a bug in ssl_write() that caused the same payload to
be sent twice in non-blocking mode when send returns EAGAIN
* Fixed ssl_parse_client_hello(): session id and challenge must
not be swapped in the SSLv2 ClientHello (found by Greg Robson)
* Added user-defined callback debug function (Krystian Kolodziej)
* Before freeing a certificate, properly zero out all cert. data
* Fixed the "mode" parameter so that encryption/decryption are
not swapped on PadLock; also fixed compilation on older versions
of gcc (bug reported by David Barrett)
* Correctly handle the case in padlock_xcryptcbc() when input or
ouput data is non-aligned by falling back to the software
implementation, as VIA Nehemiah cannot handle non-aligned buffers
* Fixed a memory leak in x509parse_crt() which was reported by Greg
Robson-Garth; some x509write.c fixes by Pascal Vizeli, thanks to
Matthew Page who reported several bugs
* Fixed x509_get_ext() to accept some rare certificates which have
an INTEGER instead of a BOOLEAN for BasicConstraints::cA.
* Added support on the client side for the TLS "hostname" extension
(patch contributed by David Patino)
* Make x509parse_verify() return BADCERT_CN_MISMATCH when an empty
string is passed as the CN (bug reported by spoofy)
* Added an option to enable/disable the BN assembly code
* Updated rsa_check_privkey() to verify that (D*E) = 1 % (P-1)*(Q-1)
* Disabled obsolete hash functions by default (MD2, MD4); updated
selftest and benchmark to not test ciphers that have been disabled
* Updated x509parse_cert_info() to correctly display byte 0 of the
serial number, setup correct server port in the ssl client example
* Fixed a critical denial-of-service with X.509 cert. verification:
peer may cause xyssl to loop indefinitely by sending a certificate
for which the RSA signature check fails (bug reported by Benoit)
* Added test vectors for: AES-CBC, AES-CFB, DES-CBC and 3DES-CBC,
HMAC-MD5, HMAC-SHA1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512
* Fixed HMAC-SHA-384 and HMAC-SHA-512 (thanks to Josh Sinykin)
* Modified ssl_parse_client_key_exchange() to protect against
Daniel Bleichenbacher attack on PKCS#1 v1.5 padding, as well
as the Klima-Pokorny-Rosa extension of Bleichenbacher's attack
* Updated rsa_gen_key() so that ctx->N is always nbits in size
* Fixed assembly PPC compilation errors on Mac OS X, thanks to
David Barrett and Dusan Semen
= Version 0.8 released on 2007-10-20
* Modified the HMAC functions to handle keys larger
than 64 bytes, thanks to Stephane Desneux and gary ng
* Fixed ssl_read_record() to properly update the handshake
message digests, which fixes IE6/IE7 client authentication
* Cleaned up the XYSSL* #defines, suggested by Azriel Fasten
* Fixed net_recv(), thanks to Lorenz Schori and Egon Kocjan
* Added user-defined callbacks for handling I/O and sessions
* Added lots of debugging output in the SSL/TLS functions
* Added preliminary X.509 cert. writing by Pascal Vizeli
* Added preliminary support for the VIA PadLock routines
* Added AES-CFB mode of operation, contributed by chmike
* Added an SSL/TLS stress testing program (ssl_test.c)
* Updated the RSA PKCS#1 code to allow choosing between
RSA_PUBLIC and RSA_PRIVATE, as suggested by David Barrett
* Updated ssl_read() to skip 0-length records from OpenSSL
* Fixed the make install target to comply with *BSD make
* Fixed a bug in mpi_read_binary() on 64-bit platforms
* mpi_is_prime() speedups, thanks to Kevin McLaughlin
* Fixed a long standing memory leak in mpi_is_prime()
* Replaced realloc with malloc in mpi_grow(), and set
the sign of zero as positive in mpi_init() (reported
by Jonathan M. McCune)
= Version 0.7 released on 2007-07-07
* Added support for the MicroBlaze soft-core processor
* Fixed a bug in ssl_tls.c which sometimes prevented SSL
connections from being established with non-blocking I/O
* Fixed a couple bugs in the VS6 and UNIX Makefiles
* Fixed the "PIC register ebx clobbered in asm" bug
* Added HMAC starts/update/finish support functions
* Added the SHA-224, SHA-384 and SHA-512 hash functions
* Fixed the net_set_*block routines, thanks to Andreas
* Added a few demonstration programs: md5sum, sha1sum,
dh_client, dh_server, rsa_genkey, rsa_sign, rsa_verify
* Added new bignum import and export helper functions
* Rewrote README.txt in program/ssl/ca to better explain
how to create a test PKI
= Version 0.6 released on 2007-04-01
* Ciphers used in SSL/TLS can now be disabled at compile
time, to reduce the memory footprint on embedded systems
* Added multiply assembly code for the TriCore and modified
havege_struct for this processor, thanks to David Patiño
* Added multiply assembly code for 64-bit PowerPCs,
thanks to Peking University and the OSU Open Source Lab
* Added experimental support of Quantum Cryptography
* Added support for autoconf, contributed by Arnaud Cornet
* Fixed "long long" compilation issues on IA-64 and PPC64
* Fixed a bug introduced in xyssl-0.5/timing.c: hardclock
was not being correctly defined on ARM and MIPS
= Version 0.5 released on 2007-03-01
* Added multiply assembly code for SPARC and Alpha
* Added (beta) support for non-blocking I/O operations
* Implemented session resuming and client authentication
* Fixed some portability issues on WinCE, MINIX 3, Plan9
(thanks to Benjamin Newman), HP-UX, FreeBSD and Solaris
* Improved the performance of the EDH key exchange
* Fixed a bug that caused valid packets with a payload
size of 16384 bytes to be rejected
= Version 0.4 released on 2007-02-01
* Added support for Ephemeral Diffie-Hellman key exchange
* Added multiply asm code for SSE2, ARM, PPC, MIPS and M68K
* Various improvement to the modular exponentiation code
* Rewrote the headers to generate the API docs with doxygen
* Fixed a bug in ssl_encrypt_buf (incorrect padding was
generated) and in ssl_parse_client_hello (max. client
version was not properly set), thanks to Didier Rebeix
* Fixed another bug in ssl_parse_client_hello: clients with
cipherlists larger than 96 bytes were incorrectly rejected
* Fixed a couple memory leak in x509_read.c
= Version 0.3 released on 2007-01-01
* Added server-side SSLv3 and TLSv1.0 support
* Multiple fixes to enhance the compatibility with g++,
thanks to Xosé Antón Otero Ferreira
* Fixed a bug in the CBC code, thanks to dowst; also,
the bignum code is no longer dependant on long long
* Updated rsa_pkcs1_sign to handle arbitrary large inputs
* Updated timing.c for improved compatibility with i386
and 486 processors, thanks to Arnaud Cornet
= Version 0.2 released on 2006-12-01
* Updated timing.c to support ARM and MIPS arch
* Updated the MPI code to support 8086 on MSVC 1.5
* Added the copyright notice at the top of havege.h
* Fixed a bug in sha2_hmac, thanks to newsoft/Wenfang Zhang
* Fixed a bug reported by Adrian Rüegsegger in x509_read_key
* Fixed a bug reported by Torsten Lauter in ssl_read_record
* Fixed a bug in rsa_check_privkey that would wrongly cause
valid RSA keys to be dismissed (thanks to oldwolf)
* Fixed a bug in mpi_is_prime that caused some primes to fail
the Miller-Rabin primality test
I'd also like to thank Younès Hafri for the CRUX linux port,
Khalil Petit who added XySSL into pkgsrc and Arnaud Cornet
who maintains the Debian package :-)
= Version 0.1 released on 2006-11-01
DESTDIR=/usr/local
PREFIX=xyssl_
.SILENT:
all:
cd library && make all && cd ..
cd programs && make all && cd ..
install:
mkdir -p $(DESTDIR)/include/xyssl
cp -r include/xyssl $(DESTDIR)/include
mkdir -p $(DESTDIR)/lib
cp library/libxyssl.* $(DESTDIR)/lib
mkdir -p $(DESTDIR)/bin
for p in programs/*/* ; do \
if [ -x $$p ] && [ ! -d $$p ] ; \
then \
f=$(PREFIX)`basename $$p` ; \
cp $$p $(DESTDIR)/bin/$$f ; \
fi \
done
clean:
cd library && make clean && cd ..
cd programs && make clean && cd ..
XySSL.png

27.1 KB

#!/bin/sh
indent --blank-lines-after-declarations \
--blank-lines-after-procedures \
--swallow-optional-blank-lines \
--blank-lines-before-block-comments \
--format-all-comments \
--format-first-column-comments \
--comment-delimiters-on-blank-lines \
--start-left-side-of-comments \
--braces-after-if-line \
--braces-after-struct-decl-line \
--brace-indent 0 \
--dont-cuddle-else \
--dont-cuddle-do-while \
--case-indentation 4 \
--case-brace-indentation 0 \
--dont-space-special-semicolon \
--no-space-after-function-call-names \
--no-space-after-casts \
--no-space-after-for \
--no-space-after-if \
--no-space-after-while \
--space-after-parentheses \
--no-blank-lines-after-commas \
--break-function-decl-args \
--dont-break-function-decl-args-end \
--dont-break-procedure-type \
--indent-level 4 \
--continue-at-parentheses \
"$@"
/**
* \file aes.h
*/
#ifndef XYSSL_AES_H
#define XYSSL_AES_H
#define AES_ENCRYPT 1
#define AES_DECRYPT 0
/**
* \brief AES context structure
*/
typedef struct
{
int nr; /*!< number of rounds */
unsigned long *rk; /*!< AES round keys */
unsigned long buf[68]; /*!< unaligned data */
}
aes_context;
#ifdef __cplusplus
extern "C" {
#endif
/**
* \brief AES key schedule (encryption)
*
* \param ctx AES context to be initialized
* \param key encryption key
* \param keysize must be 128, 192 or 256
*/
void aes_setkey_enc( aes_context *ctx, unsigned char *key, int keysize );
/**
* \brief AES key schedule (decryption)
*
* \param ctx AES context to be initialized
* \param key decryption key
* \param keysize must be 128, 192 or 256
*/
void aes_setkey_dec( aes_context *ctx, unsigned char *key, int keysize );
/**
* \brief AES-ECB block encryption/decryption
*
* \param ctx AES context
* \param mode AES_ENCRYPT or AES_DECRYPT
* \param input 16-byte input block
* \param output 16-byte output block
*/
void aes_crypt_ecb( aes_context *ctx,
int mode,
unsigned char input[16],
unsigned char output[16] );
/**
* \brief AES-CBC buffer encryption/decryption
*
* \param ctx AES context
* \param mode AES_ENCRYPT or AES_DECRYPT
* \param length length of the input data
* \param iv initialization vector (updated after use)
* \param input buffer holding the input data
* \param output buffer holding the output data
*/
void aes_crypt_cbc( aes_context *ctx,
int mode,
int length,
unsigned char iv[16],
unsigned char *input,
unsigned char *output );
/**
* \brief AES-CFB128 buffer encryption/decryption
*
* \param ctx AES context
* \param mode AES_ENCRYPT or AES_DECRYPT
* \param length length of the input data
* \param iv_off offset in IV (updated after use)
* \param iv initialization vector (updated after use)
* \param input buffer holding the input data
* \param output buffer holding the output data
*/
void aes_crypt_cfb128( aes_context *ctx,
int mode,
int length,
int *iv_off,
unsigned char iv[16],
unsigned char *input,
unsigned char *output );
/**
* \brief Checkup routine
*
* \return 0 if successful, or 1 if the test failed
*/
int aes_self_test( int verbose );
#ifdef __cplusplus
}
#endif
#endif /* aes.h */
/**
* \file arc4.h
*/
#ifndef XYSSL_ARC4_H
#define XYSSL_ARC4_H
/**
* \brief ARC4 context structure
*/
typedef struct
{
int x; /*!< permutation index */
int y; /*!< permutation index */
unsigned char m[256]; /*!< permutation table */
}
arc4_context;
#ifdef __cplusplus
extern "C" {
#endif
/**
* \brief ARC4 key schedule
*
* \param ctx ARC4 context to be initialized
* \param key the secret key
* \param keylen length of the key
*/
void arc4_setup( arc4_context *ctx, unsigned char *key, int keylen );
/**
* \brief ARC4 cipher function
*
* \param ctx ARC4 context
* \param buf buffer to be processed
* \param buflen amount of data in buf
*/
void arc4_crypt( arc4_context *ctx, unsigned char *buf, int buflen );
/*
* \brief Checkup routine
*
* \return 0 if successful, or 1 if the test failed
*/
int arc4_self_test( int verbose );
#ifdef __cplusplus
}
#endif
#endif /* arc4.h */
/**
* \file base64.h
*/
#ifndef XYSSL_BASE64_H
#define XYSSL_BASE64_H
#define XYSSL_ERR_BASE64_BUFFER_TOO_SMALL -0x0010
#define XYSSL_ERR_BASE64_INVALID_CHARACTER -0x0012
#ifdef __cplusplus
extern "C" {
#endif
/**
* \brief Encode a buffer into base64 format
*
* \param dst destination buffer
* \param dlen size of the buffer
* \param src source buffer
* \param slen amount of data to be encoded
*
* \return 0 if successful, or XYSSL_ERR_BASE64_BUFFER_TOO_SMALL.
* *dlen is always updated to reflect the amount
* of data that has (or would have) been written.
*
* \note Call this function with *dlen = 0 to obtain the
* required buffer size in *dlen
*/
int base64_encode( unsigned char *dst, int *dlen,
unsigned char *src, int slen );
/**
* \brief Decode a base64-formatted buffer
*
* \param dst destination buffer
* \param dlen size of the buffer
* \param src source buffer
* \param slen amount of data to be decoded
*
* \return 0 if successful, XYSSL_ERR_BASE64_BUFFER_TOO_SMALL, or
* XYSSL_ERR_BASE64_INVALID_DATA if the input data is not
* correct. *dlen is always updated to reflect the amount
* of data that has (or would have) been written.
*
* \note Call this function with *dlen = 0 to obtain the
* required buffer size in *dlen
*/
int base64_decode( unsigned char *dst, int *dlen,
unsigned char *src, int slen );
/**
* \brief Checkup routine
*
* \return 0 if successful, or 1 if the test failed
*/
int base64_self_test( int verbose );
#ifdef __cplusplus
}
#endif
#endif /* base64.h */
This diff is collapsed.
This diff is collapsed.
/**
* \file certs.h
*/
#ifndef XYSSL_CERTS_H
#define XYSSL_CERTS_H
#ifdef __cplusplus
extern "C" {
#endif
extern char test_ca_crt[];
extern char test_ca_key[];
extern char test_ca_pwd[];
extern char test_srv_crt[];
extern char test_srv_key[];
extern char test_cli_crt[];
extern char test_cli_key[];
extern char xyssl_ca_crt[];
#ifdef __cplusplus
}
#endif
#endif /* certs.h */
/**
* \file config.h
*
* This set of compile-time options may be used to enable
* or disable features selectively, and reduce the global
* memory footprint.
*/
#ifndef XYSSL_CONFIG_H
#define XYSSL_CONFIG_H
#ifndef _CRT_SECURE_NO_DEPRECATE
#define _CRT_SECURE_NO_DEPRECATE 1
#endif
/*
* Uncomment if native integers are 8-bit wide.
*
#define XYSSL_HAVE_INT8
*/
/*
* Uncomment if native integers are 16-bit wide.
*
#define XYSSL_HAVE_INT16
*/
/*
* Uncomment if the compiler supports long long.
*
#define XYSSL_HAVE_LONGLONG
*/
/*
* Uncomment to enable the use of assembly code.
*/
#define XYSSL_HAVE_ASM
/*
* Uncomment if the CPU supports SSE2 (IA-32 specific).
*
#define XYSSL_HAVE_SSE2
*/
/*
* Enable all SSL/TLS debugging messages.
*/
#define XYSSL_DEBUG_MSG
/*
* Enable the checkup functions (*_self_test).
*/
#define XYSSL_SELF_TEST
/*
* Enable the prime-number generation code.
*/
#define XYSSL_GENPRIME
/*
* Uncomment this macro to store the AES tables in ROM.
*
#define XYSSL_AES_ROM_TABLES
*/
/*
* Module: library/aes.c
* Caller: library/ssl_tls.c
*
* This module enables the following ciphersuites:
* SSL_RSA_AES_128_SHA
* SSL_RSA_AES_256_SHA
* SSL_EDH_RSA_AES_256_SHA
*/
#define XYSSL_AES_C
/*
* Module: library/arc4.c
* Caller: library/ssl_tls.c
*
* This module enables the following ciphersuites:
* SSL_RSA_RC4_128_MD5
* SSL_RSA_RC4_128_SHA
*/
#define XYSSL_ARC4_C
/*
* Module: library/base64.c
* Caller: library/x509parse.c
*
* This module is required for X.509 support.
*/
#define XYSSL_BASE64_C
/*
* Module: library/bignum.c
* Caller: library/dhm.c
* library/rsa.c
* library/ssl_tls.c
* library/x509parse.c
*
* This module is required for RSA and DHM support.
*/
#define XYSSL_BIGNUM_C
/*
* Module: library/certs.c
* Caller:
*
* This module is used for testing (ssl_client/server).
*/
#define XYSSL_CERTS_C
/*
* Module: library/debug.c
* Caller: library/ssl_cli.c
* library/ssl_srv.c
* library/ssl_tls.c
*
* This module provides debugging functions.
*/
#define XYSSL_DEBUG_C
/*
* Module: library/des.c
* Caller: library/ssl_tls.c
*
* This module enables the following ciphersuites:
* SSL_RSA_DES_168_SHA
* SSL_EDH_RSA_DES_168_SHA
*/
#define XYSSL_DES_C
/*
* Module: library/dhm.c
* Caller: library/ssl_cli.c
* library/ssl_srv.c
*
* This module enables the following ciphersuites:
* SSL_EDH_RSA_DES_168_SHA
* SSL_EDH_RSA_AES_256_SHA
*/
#define XYSSL_DHM_C
/*
* Module: library/havege.c
* Caller:
*
* This module enables the HAVEGE random number generator.
*/
#define XYSSL_HAVEGE_C
/*
* Module: library/md2.c
* Caller: library/x509parse.c
*
* Uncomment to enable support for (rare) MD2-signed X.509 certs.
*
#define XYSSL_MD2_C
*/
/*
* Module: library/md4.c
* Caller: library/x509parse.c
*
* Uncomment to enable support for (rare) MD4-signed X.509 certs.
*
#define XYSSL_MD4_C
*/
/*
* Module: library/md5.c
* Caller: library/ssl_tls.c
* library/x509parse.c
*
* This module is required for SSL/TLS and X.509.
*/
#define XYSSL_MD5_C
/*
* Module: library/net.c
* Caller:
*
* This module provides TCP/IP networking routines.
*/
#define XYSSL_NET_C
/*
* Module: library/padlock.c
* Caller: library/aes.c
*
* This modules adds support for the VIA PadLock on x86.
*/
#define XYSSL_PADLOCK_C
/*
* Module: library/rsa.c
* Caller: library/ssl_cli.c
* library/ssl_srv.c
* library/ssl_tls.c
* library/x509.c
*
* This module is required for SSL/TLS and MD5-signed certificates.
*/
#define XYSSL_RSA_C
/*
* Module: library/sha1.c
* Caller: library/ssl_cli.c
* library/ssl_srv.c
* library/ssl_tls.c
* library/x509parse.c
*
* This module is required for SSL/TLS and SHA1-signed certificates.
*/
#define XYSSL_SHA1_C
/*
* Module: library/sha2.c
* Caller:
*
* This module adds support for SHA-224 and SHA-256.
*/
#define XYSSL_SHA2_C
/*
* Module: library/sha4.c
* Caller:
*
* This module adds support for SHA-384 and SHA-512.
*/
#define XYSSL_SHA4_C
/*
* Module: library/ssl_cli.c
* Caller:
*
* This module is required for SSL/TLS client support.
*/
#define XYSSL_SSL_CLI_C
/*
* Module: library/ssl_srv.c
* Caller:
*
* This module is required for SSL/TLS server support.
*/
#define XYSSL_SSL_SRV_C
/*
* Module: library/ssl_tls.c
* Caller: library/ssl_cli.c
* library/ssl_srv.c
*
* This module is required for SSL/TLS.
*/