| 4497fdc7e8a775eccb882b42a9314de09ee6c67f |
|
06-Jan-2015 |
Narayan Kamath <narayan@google.com> |
Treat SSL_ERROR_ZERO_RETURN correctly.
According to ssl_lib.c, this is returned whenever the socket
is being closed (s->shutdown && SSL_RECEIVED_SHUTDOWN &&
s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY).
(cherry picked from commit f6c8f8b4891a91178e45b90f34f9d8c97737044a)
Bug: 18758595
Change-Id: Ied7b3e18f11786351d42a770f4cad11ddae29ff3
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| cc638d868d2e560285e31630b94fc22c538379a4 |
|
10-Dec-2014 |
Narayan Kamath <narayan@google.com> |
Merge "Call EVP_CIPHER_CTX_free instead of EVP_CIPHER_CTX_cleanup." into lmp-mr1-dev
|
| c64652932d8e17ccf7e54c0c76c1b38a86841732 |
|
10-Dec-2014 |
Narayan Kamath <narayan@google.com> |
Call EVP_CIPHER_CTX_free instead of EVP_CIPHER_CTX_cleanup.
The latter doesn't OpenSSL_free memory allocated by EVP_CIPHER_CTX_new.
It's worth noting that EVP_CIPHER_CTX_free doesn't check the return
value of EVP_CIPHER_CTX_cleanup so we can't throw if cleanup failed, but
we were only ever calling this method from a finalizer anyway.
bug: 18617384
Change-Id: Ida65e14ffbed41f56a59e2f5fe77289cac0f5947
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| f1c5b6d8141af1548cf3db4d4514e14c4e841074 |
|
09-Dec-2014 |
Kenny Root <kroot@google.com> |
NativeCrypto: empty data content for PKCS7 container
The EncapsulatedContentInfo must be present in the output, but OpenSSL
will fill in a zero-length OID if you don't call PKCS7_set_content on the
outer PKCS7 container. So we construct an empty PKCS7 data container and
set it as the content. This fixes the invalid PKCS7 output.
(cherry picked from commit 525df9b12c1eb77db9f1b2b8fa5d41f779b9afa6)
Bug: 18664989
Change-Id: I6f4cf785dd02ee40f1951d098fa987aa25d2421a
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 058faf1e3a8978cca7c9898ccd692fa5b738a180 |
|
08-Dec-2014 |
Kenny Root <kroot@google.com> |
NativeCrypto: throw BadPaddingException if EVP_CipherFinal_ex fails
Since nothing was being pushed onto the stack, no exception was thrown
in throwExceptionIfNecessary with the constant time fix present in
1.0.1j. The fix is to throw our own error if nothing was thrown.
(cherry picked from commit e74933ecfb7dc7d91ebe6620a91d86fdc735ed58)
Bug: 18621207
Change-Id: I25e653c493e162c5fda46f320117c013a2661aa4
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 53497d005a470123806d23a5d36e86cee88eafbd |
|
08-Dec-2014 |
Kenny Root <kroot@google.com> |
OpenSSLCipherRSA: add new reason to exception mapping
1.0.1j introduced a new error reason for RSA padding checks that wasn't
mapped resulting in a RuntimeException. Add this to the list of reasons
so we throw the correct BadPaddingException.
(cherry picked from commit 70e75e74134d8a2cbd1569565fac7d34df5fe7da)
Bug: 18665649
Change-Id: I96ce13f6dee10ca89e74c558ecb338f9dbd907ba
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 5fc043d366bc711d1315802e504bcb253b783085 |
|
01-Dec-2014 |
Kenny Root <kroot@google.com> |
Clear SSL state safely
Since SSL_clear can fail, we should clear the OpenSSL ERR stack if it
does fail. However, to aid in spotting bugs, only clear the stack if the
SSL_clear itself fails.
(cherry picked from commit 86dd832ac26112890b3e815a144ff062ae9b3559)
Bug: 18570895
Change-Id: I053d2e2792e64923c1e128b4fcae23b2e660a992
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 4b8721e2c2711ced7c0569b95e42da6ffb54141c |
|
17-Nov-2014 |
Kenny Root <kroot@google.com> |
Preserve errors to get the correct exception
During the switch to BoringSSL, agl noticed the error state wasn't being
preserved correctly. Integrate part of the BoringSSL change to preserve
error states.
(cherry picked from commit 2ba24c83d9136bccf60f8638130335066a189b95)
Bug: 18388980
Change-Id: I9a6fea4f3bf457808a337604290c6bfd1b9ea84e
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| dac92c69d3a147ea57bc7bd28c96b6365c1988e2 |
|
14-Nov-2014 |
Kenny Root <kroot@google.com> |
Squashed commit of changes from lmp-ub-dev
Contains the following changes:
commit e31d982cdb0f8e6ef05d1e412576888015e1da17
Merge: eaebc54 b73be72
Author: Neil Fuller <nfuller@google.com>
Date: Wed Oct 22 10:34:23 2014 +0000
am b73be72e: am 3e21a289: (-s ours) TLS_FALLBACK_SCSV CTS fix for klp-modular-dev
* commit 'b73be72ed97da8f36450d95d52f485cc6f451c61':
TLS_FALLBACK_SCSV CTS fix for klp-modular-dev
commit eaebc544f3a10c53d7d2f908514122caba569e14
Merge: 223b5da cd50afa
Author: Kenny Root <kroot@google.com>
Date: Tue Oct 14 17:30:19 2014 +0000
Merge "Fix SSLEngine to support session resumption." into lmp-ub-dev
commit 223b5da5d70e47b1a497e86474493925b568f6d7
Merge: 8737796 cb7a360
Author: Neil Fuller <nfuller@google.com>
Date: Thu Oct 9 14:52:00 2014 +0000
am cb7a3605: am ea961ada: Apply conscrypt changes from merge commit
* commit 'cb7a36050f34d3c16be00d532411820761eeb276':
Apply conscrypt changes from merge commit
commit cd50afad1567b1311e6e979e94a7167b7bf69c94
Author: Doug Steedman <dougsteed@google.com>
Date: Mon Oct 6 13:16:15 2014 -0700
Fix SSLEngine to support session resumption.
Bug: 17877118
Change-Id: I388b59cde58fdc506ecac9f536e4bbd9161df6ad
commit 8737796a646eaec94df32827752a71aee74bd46f
Merge: 9564a5f 8d7e23e
Author: Kenny Root <kroot@google.com>
Date: Mon Oct 6 22:34:20 2014 +0000
am 8d7e23e1: Add support for TLS_FALLBACK_SCSV
* commit '8d7e23e117da591a8d48e6bcda9ed6f58ff1a375':
Add support for TLS_FALLBACK_SCSV
commit 9564a5fb9ed2eecf6299788db35213cb08397212
Merge: 4f58feb 7640613
Author: Kenny Root <kroot@google.com>
Date: Fri Sep 12 17:27:23 2014 +0000
am 76406135: am 6dcb23fe: am f427ec90: Fix the ENGINE_finish/ENGINE_free mixup
* commit '76406135cf3a3b88afc979fe8e847b9c3d8b93c1':
Fix the ENGINE_finish/ENGINE_free mixup
commit 4f58feb0ea49dc089a95efba196032ef3c960a39
Merge: ddac5c6 984b7ec
Author: Kenny Root <kroot@google.com>
Date: Wed Sep 10 07:07:16 2014 +0000
am 984b7ec6: Fix the ENGINE_finish/ENGINE_free mixup
* commit '984b7ec6f5aab314117949a48e448ff4f6b65f16':
Fix the ENGINE_finish/ENGINE_free mixup
commit ddac5c6d7e413b0d68b388fbdf70dbeb3eeae865
Merge: 5a8ca5b 36ba60b
Author: Kenny Root <kroot@google.com>
Date: Thu Sep 4 22:41:38 2014 +0000
Merge "Reset lmp-ub-dev to lmp-dev-plus-aosp" into lmp-ub-dev
commit 36ba60b039f1f30ab1ea8f0e2a4da8ae4e3906e5
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 27 12:07:07 2014 -0700
Reset lmp-ub-dev to lmp-dev-plus-aosp
Bug: 17059757
Change-Id: I581963360da47b574e1e2e20c2851485c36fa62c
commit 6a4f2ef9e4ea3ebb321d45ca39b30d634ea3b4ad
Merge: 9b187af f67d784
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 26 04:17:38 2014 +0000
am f67d784a: Add pre-Honeycomb literal IP matching
* commit 'f67d784abe5cef700240be02c68cecd899cd8e6d':
Add pre-Honeycomb literal IP matching
commit 9b187af33dcd97915a0371d64fe1ee4aba20d0ba
Merge: 714ebea 966ae8a
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 26 04:17:37 2014 +0000
am 966ae8a6: Read property to enable SNI
* commit '966ae8a6e12f3235b1cb041e687bda11b41fe4eb':
Read property to enable SNI
commit 714ebeabcb5e35c6df6a5c21f549cdb6130368c4
Merge: 7724204 54a1ba4
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 26 04:06:54 2014 +0000
Merge "resolved conflicts for merge of 342097db to lmp-dev-plus-aosp" into lmp-dev-plus-aosp
commit 54a1ba421d23bb6d988688c2662715e509172447
Merge: a20d871 342097d
Author: Kenny Root <kroot@google.com>
Date: Mon Aug 25 21:03:51 2014 -0700
resolved conflicts for merge of 342097db to lmp-dev-plus-aosp
Change-Id: I853c6b0d3725dafbdc84c4d6d6d1b90529bd949d
commit 7724204abf4431d35787c44c4a22cda5489d4e37
Merge: 20f60ac afb3403
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 26 00:09:27 2014 +0000
am afb34034: Implement write socket timeouts for unbundled apps
* commit 'afb340348bfc54dbc46964e159fe803f9c93a4dd':
Implement write socket timeouts for unbundled apps
commit f67d784abe5cef700240be02c68cecd899cd8e6d
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 20 14:14:26 2014 -0700
Add pre-Honeycomb literal IP matching
This will allow us to run this code on Gingerbread devices and others
that don't have the InetAddress#isNumeric API.
Bug: 16658420
Bug: 17059757
Change-Id: I597d539979d58eeaa2677d6f99e911313a550cc1
commit 966ae8a6e12f3235b1cb041e687bda11b41fe4eb
Author: Kenny Root <kroot@google.com>
Date: Mon Aug 18 10:12:20 2014 -0700
Read property to enable SNI
Read the system property "jsse.enableSNIExtension" on whether to enable
Server Name Indication (SNI) extension. For unbundled builds, this will
be enabled by default. For platform builds, this will be disabled by
default.
Bug: 16658420
Bug: 17059757
Change-Id: I774f5406bf3fe601a42c4ef5e708b31800147eb9
commit 342097db97a9b2736531033b2c4b4d8ce4998c67
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 20 12:14:52 2014 -0700
Validate hostname is usable for SNI
According to RFC 6066 section 3, the hostname listed in the Server Name
Indication (SNI) field is a fully qualified domain name and IP
addresses are not permitted.
Bug: 16658420
Bug: 17059757
Change-Id: I804e46b6e66599b2770f0f4f0534467987e51208
commit afb340348bfc54dbc46964e159fe803f9c93a4dd
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 19 16:33:07 2014 -0700
Implement write socket timeouts for unbundled apps
Change-Id: I4fd604f057ba4288d4f31bf6b3b93307376023d5
commit 20f60acea153dfdf0c8f75a53d7bd9edb4c7614c
Author: Kenny Root <kroot@google.com>
Date: Mon Aug 25 11:52:05 2014 -0700
Tracking change from AOSP
Change-Id: I889af3f7c1de9ef34d9328339e1b421651055ad4
commit 68056b7c9db8a9fb384bbadfc5287730f996896d
Merge: 8239dfd cc2ef2e
Author: Kenny Root <kroot@google.com>
Date: Mon Aug 25 18:03:27 2014 +0000
am cc2ef2e2: Rename hostname fields and methods to reflect usage
* commit 'cc2ef2e2e9ee64f2e0ac2abc7fdf636e2f81fa5e':
Rename hostname fields and methods to reflect usage
commit 8239dfdcc40a69255d7b2feced960d574ea36321
Merge: e9cf759 076138f
Author: Kenny Root <kroot@google.com>
Date: Thu Aug 21 16:36:24 2014 +0000
am 076138ff: Use consistent naming for SSLSocket arguments
* commit '076138ff29d805ec5a32d6ad96a18ef08c7f1b11':
Use consistent naming for SSLSocket arguments
commit cc2ef2e2e9ee64f2e0ac2abc7fdf636e2f81fa5e
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 20 11:26:33 2014 -0700
Rename hostname fields and methods to reflect usage
The hostname that was supplied when the socket was created is stored as
the "peerHostname" This is the only one that should be used for Server
Name Indication (SNI) purposes.
The "peerHostname" or the resolved IP address may be used for
certificate validation, so keep the use of "getHostname()" for
cerificate validation.
Bug: 16658420
Bug: 17059757
Change-Id: Ifd87dead44fb2f00bbfd5eac7e69fb3fc98e94b4
commit 076138ff29d805ec5a32d6ad96a18ef08c7f1b11
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 20 11:24:41 2014 -0700
Use consistent naming for SSLSocket arguments
This changes all the 'host' to be 'hostname' and anything that takes an
'InetAddress' will have the name of 'address' to avoid confusing it with
a hostname.
Bug: 16658420
Bug: 17059757
Change-Id: Iac0628d2d156023dbb80c2e636af6bfe63f46650
commit e9cf759ac89fb053c01f1db19931beb14a823618
Merge: ababdd1 7ed0fae
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 19 19:32:43 2014 +0000
am 7ed0fae1: OpenSSLEngineImpl: reduce number of copies needed
* commit '7ed0fae1906061766d0042e69ccba20e4a702bbe':
OpenSSLEngineImpl: reduce number of copies needed
commit 7ed0fae1906061766d0042e69ccba20e4a702bbe
Author: Kenny Root <kroot@google.com>
Date: Tue Jul 22 13:03:09 2014 -0700
OpenSSLEngineImpl: reduce number of copies needed
When the ByteBuffer didn't line up exactly with the backing array, it
would allocate a new buffer to write into. Instead, add the ability for
OpenSSL to read at an offset in the given array so a copy isn't needed.
Change-Id: I149d3f94e4b5cbdc010df80439ae3300cbdc87a5
commit ababdd1ae1272eac174e3a449a413ab35afbc435
Merge: 66c31e0 4b050b6
Author: Kenny Root <kroot@google.com>
Date: Fri Aug 15 16:23:14 2014 +0000
am 4b050b6f: OpenSSLSocketImpl: Move state checks inside mutex
* commit '4b050b6fb06fbb804557eecc72cc4ff0e0277525':
OpenSSLSocketImpl: Move state checks inside mutex
commit 66c31e0b613ceefc167a2e1fb226a14c78f84537
Merge: f4b895a 0931d51
Author: Kenny Root <kroot@google.com>
Date: Thu Aug 14 20:46:43 2014 +0000
am 0931d51c: OpenSSLSocketImpl: Move state checks inside mutex
* commit '0931d51c58b2dc2f612298f99fbf0fa6ed4c3706':
OpenSSLSocketImpl: Move state checks inside mutex
commit 0931d51c58b2dc2f612298f99fbf0fa6ed4c3706
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 5 15:45:32 2014 -0700
OpenSSLSocketImpl: Move state checks inside mutex
Checking the state of the connection is unreliable if SSL_read and
SSL_write are happening in another thread. Move the state checks inside
our application mutex so we don't run into another thread mutating the
state at the same time.
Bug: 15606096
Change-Id: I5ecdeb1551a13098d1b66c5e4009607c9951fa38
commit f4b895ae9c424b5c2d49c744131606adccbc49d7
Merge: a35c400 a260ee6
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 13 15:35:28 2014 +0000
am a260ee6d: Revert "Revert "Automatic management of OpenSSL error stack""
* commit 'a260ee6d0caea43f8010f158a4a35fb712935ae3':
Revert "Revert "Automatic management of OpenSSL error stack""
commit a35c40017c8690f821351d6460dfeaa2738b884c
Merge: 0edc483 30550a8
Author: Kenny Root <kroot@google.com>
Date: Wed Aug 13 15:35:27 2014 +0000
am 30550a8b: Fix debugging with unbundled conscrypt
* commit '30550a8b64bbcd6ca537680a17b8726932a29937':
Fix debugging with unbundled conscrypt
commit a260ee6d0caea43f8010f158a4a35fb712935ae3
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 12 15:38:10 2014 -0700
Revert "Revert "Automatic management of OpenSSL error stack""
The "else" statement in OpenSslError::reset wasn't properly resetting
the error state which made a second call into sslRead jump into
sslSelect when it should have just returned immediately.
Change-Id: I22e8025c0497a04e78daa07cef78191a6ca1a70c
commit 30550a8b64bbcd6ca537680a17b8726932a29937
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 12 15:13:33 2014 -0700
Fix debugging with unbundled conscrypt
When JNI_TRACE was enabled, there were missing defines for the debugging
code since no platform code is included.
Also clang complains about more of the debugging statement formats, so
we have to move some things around to get it to be happy.
Change-Id: I1a6695c2ef2639cc01cfc3d3a8603f010c659844
commit 0edc4833091846d6cb45961fc9458df842fbbad9
Merge: 107a8fb 2411b8b
Author: Kenny Root <kroot@android.com>
Date: Tue Aug 12 21:46:12 2014 +0000
am 2411b8bd: Merge "Revert "Automatic management of OpenSSL error stack""
* commit '2411b8bdcde72c956f4150e9a5909b7501f50bad':
Revert "Automatic management of OpenSSL error stack"
commit 2411b8bdcde72c956f4150e9a5909b7501f50bad
Merge: 3262a8c b514d72
Author: Kenny Root <kroot@android.com>
Date: Tue Aug 12 21:39:32 2014 +0000
Merge "Revert "Automatic management of OpenSSL error stack""
commit b514d72b93c3996d97e38eca6db1ad684965fd9b
Author: Kenny Root <kroot@android.com>
Date: Tue Aug 12 21:39:17 2014 +0000
Revert "Automatic management of OpenSSL error stack"
This reverts commit 35666e4cb0fcd063a21d17eebbb571b4e4e822b8.
Change-Id: I926d159c4c4b99250caef750732976c1e601e9ef
commit 107a8fba8be5be57933f2638b76ac1243b578b9e
Merge: 1de007f 3262a8c
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 12 15:50:14 2014 +0000
am 3262a8c2: Merge "Automatic management of OpenSSL error stack"
* commit '3262a8c2741b95103149bcdefe2409c24bfddee9':
Automatic management of OpenSSL error stack
commit 1de007f9f01be8f07a56235dd924c897088a03cb
Merge: 94890ae d1bbcd0
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 12 15:50:14 2014 +0000
am d1bbcd0e: Relax checks for key vs cert for wrapped keys
* commit 'd1bbcd0ec973e1b8465c204c13b4925fd86e6484':
Relax checks for key vs cert for wrapped keys
commit 3262a8c2741b95103149bcdefe2409c24bfddee9
Merge: d1bbcd0 35666e4
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 12 15:31:02 2014 +0000
Merge "Automatic management of OpenSSL error stack"
commit d1bbcd0ec973e1b8465c204c13b4925fd86e6484
Author: Kenny Root <kroot@google.com>
Date: Mon Aug 11 14:56:58 2014 -0700
Relax checks for key vs cert for wrapped keys
If a key is a wrapped platform key, we must relax the check. The reason
is that we may not have the public values we need to pass the
EVP_PKEY_cmp checks that this does.
Change-Id: I7ab2be51b0968a9cf771edea01d33fe2367c8185
commit 35666e4cb0fcd063a21d17eebbb571b4e4e822b8
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 5 11:05:00 2014 -0700
Automatic management of OpenSSL error stack
This removes some complexity in remembering to free the OpenSSL error
stack. If you forget, the error will stick around until you make another
call.
Change-Id: I245a525dcc93077b2bf9909a14a0ef469a2daca4
commit 94890aec5735cde2ea5170fb76cd1b847ea66af8
Merge: 8360485 977f087
Author: Kenny Root <kroot@google.com>
Date: Tue Aug 5 16:44:42 2014 +0000
am 977f0877: Fix some JNI_TRACE lines
* commit '977f08774c628b4640d5454cde050259856965f8':
Fix some JNI_TRACE lines
commit 977f08774c628b4640d5454cde050259856965f8
Author: Kenny Root <kroot@google.com>
Date: Mon Aug 4 12:15:04 2014 -0700
Fix some JNI_TRACE lines
During debugging these would be enabled, but they were copy-pasta'd to
with the wrong args.
Change-Id: I23f39ff4807e3fa71f3220912aec3c99db6b9454
commit 83604854c5160304cafefc9bd40a72c5ee8506eb
Merge: 7db3524 1ffe43e
Author: Zoltan Szatmary-Ban <szatmz@google.com>
Date: Thu Jul 31 13:28:57 2014 +0000
am 1ffe43e8: Merge "Add possibility to get deleted system Certificate Aliases" into lmp-dev
* commit '1ffe43e8277e883c6663c1fb7cfc5e18ba552c40':
Add possibility to get deleted system Certificate Aliases
commit 7db3524880092126962b7f502af76b4c84da7350
Merge: 5767d63 ad0cd83
Author: Prameet Shah <phshah@google.com>
Date: Wed Jul 30 17:04:13 2014 +0000
am ad0cd830: Added CLOSED_INBOUND and CLOSED_OUTBOUND states to OpenSSLEngineImpl#getHandshakeStatus()
* commit 'ad0cd83024f38011043d28d70370a8638b88cd72':
Added CLOSED_INBOUND and CLOSED_OUTBOUND states to OpenSSLEngineImpl#getHandshakeStatus()
commit 5767d63d22e87becab387b3bd6597fe41eb34d7e
Merge: b389e17 26163c2
Author: Prameet Shah <phshah@google.com>
Date: Wed Jul 30 16:31:08 2014 +0000
am 26163c26: Added CLOSED_INBOUND and CLOSED_OUTBOUND states to OpenSSLEngineImpl#getHandshakeStatus()
* commit '26163c268a6d2625384b87e907afad8ef19f9a47':
Added CLOSED_INBOUND and CLOSED_OUTBOUND states to OpenSSLEngineImpl#getHandshakeStatus()
commit 26163c268a6d2625384b87e907afad8ef19f9a47
Author: Prameet Shah <phshah@google.com>
Date: Tue Jul 29 16:45:31 2014 -0700
Added CLOSED_INBOUND and CLOSED_OUTBOUND states to OpenSSLEngineImpl#getHandshakeStatus()
Bug: https://code.google.com/p/android/issues/detail?id=73745
Change-Id: I5bcaf3ee8910ff75e785baed4c4604fee6c5e700
commit b389e1779651f2c58454a5f98acebd3dd7bc0061
Merge: 5f03b4d e427972
Author: Prameet Shah <phshah@google.com>
Date: Thu Jul 24 19:46:28 2014 +0000
am e427972e: OpenSSLEngineImpl: fix unwrap behavior with array
* commit 'e427972eb6141cd67e6d4c9607863a8d990e6be6':
OpenSSLEngineImpl: fix unwrap behavior with array
commit 5f03b4d63c7632581b032879de791dc82f05ffa0
Merge: 3d935ee 41eb5b6
Author: Prameet Shah <phshah@google.com>
Date: Tue Jul 22 19:26:41 2014 +0000
am 41eb5b65: OpenSSLEngineImpl: fix unwrap behavior with array
* commit '41eb5b65e524d01e28da474bd37e4349b12fb494':
OpenSSLEngineImpl: fix unwrap behavior with array
commit 41eb5b65e524d01e28da474bd37e4349b12fb494
Author: Prameet Shah <phshah@google.com>
Date: Tue Jul 22 11:50:18 2014 -0700
OpenSSLEngineImpl: fix unwrap behavior with array
The decrypted bytes should written sequentially into each buffer of
the destination array until it's full before moving to the next
buffer.
Change-Id: I2454249c167deafde6c12134d3c8cd658cd7c21b
commit 3d935eeca25e00b56cfd8d37a657c7b2986889b3
Merge: 0a36f6c affd45a
Author: Alex Klyubin <klyubin@google.com>
Date: Fri Jul 18 00:32:14 2014 +0000
am affd45a4: Merge "Improve the Javadoc of PSKKeyManager." into lmp-dev
* commit 'affd45a413cf844dad797ad4972074efb9de43d8':
Improve the Javadoc of PSKKeyManager.
commit 0a36f6c1f8b2e195c2dd5aea1a386df090c6d470
Merge: 6492180 af4fa68
Author: rich cannings <richc@google.com>
Date: Thu Jul 17 23:47:33 2014 +0000
am af4fa685: Merge "Log CCS exceptions do not merge." into lmp-dev
* commit 'af4fa685f246aaa80c93af62faadbc2fe87dc034':
Log CCS exceptions do not merge.
commit 6492180ce17a3b5ff822cff1783f00e7a4176491
Merge: aac4168 3b7268c
Author: Alex Klyubin <klyubin@google.com>
Date: Thu Jul 17 18:27:39 2014 +0000
am 3b7268cd: Merge "Improve the Javadoc of PSKKeyManager."
* commit '3b7268cde4a4fc59591da8a93691927ebf3add57':
Improve the Javadoc of PSKKeyManager.
commit aac4168d8baef7e12d6fa959c6d6ded9892e9651
Merge: 8573ad0 a749c0d
Author: Kenny Root <kroot@google.com>
Date: Thu Jul 17 17:07:05 2014 +0000
am a749c0d3: Keep enough state to completely reset cipher instances
* commit 'a749c0d351216be38879600ee8ed01c6793aa256':
Keep enough state to completely reset cipher instances
commit 8573ad0ddcf7e2f8b2e5ac84c34b7ffab303155c
Merge: 4ca5b06 70fdb6d
Author: Koushik Dutta <koushd@gmail.com>
Date: Thu Jul 17 17:06:36 2014 +0000
am 70fdb6d2: OpenSSLEngine Impl: Fix bug where SSL Handshake never completes when using NPN.
* commit '70fdb6d2bfa0c313fe389827f0025288f6aeb947':
OpenSSLEngine Impl: Fix bug where SSL Handshake never completes when using NPN.
commit 4ca5b0625e3f5a15ae8adf833ab5a69f9d7d517f
Merge: 119abfb ded66f5
Author: Koushik Dutta <koushd@gmail.com>
Date: Thu Jul 17 17:06:35 2014 +0000
am ded66f5f: Various fixes in OpenSSLEngineImpl.
* commit 'ded66f5f696994ce7620552e16a4e9124e69e052':
Various fixes in OpenSSLEngineImpl.
commit 119abfba1fcd9c9cfbd15d0a4ca9ed2188fdfab0
Merge: 5713cdf cbe1f28
Author: Kenny Root <kroot@google.com>
Date: Thu Jul 17 15:56:57 2014 +0000
am cbe1f28a: Merge "Keep enough state to completely reset cipher instances"
* commit 'cbe1f28adf64396561a3b65bf1452dfa9b6e35ae':
Keep enough state to completely reset cipher instances
commit cbe1f28adf64396561a3b65bf1452dfa9b6e35ae
Merge: e08f238 084e308
Author: Kenny Root <kroot@google.com>
Date: Thu Jul 17 15:48:58 2014 +0000
Merge "Keep enough state to completely reset cipher instances"
commit 3b7268cde4a4fc59591da8a93691927ebf3add57
Merge: cbe1f28 7ac13e0
Author: Alex Klyubin <klyubin@google.com>
Date: Thu Jul 17 18:20:43 2014 +0000
Merge "Improve the Javadoc of PSKKeyManager."
commit 5713cdf71c5c6e5179e8369263c702e9512afdd0
Merge: cf55719 e08f238
Author: Koushik Dutta <koushd@gmail.com>
Date: Wed Jul 16 22:05:17 2014 +0000
am e08f2385: OpenSSLEngine Impl: Fix bug where SSL Handshake never completes when using NPN.
* commit 'e08f238580e8ee471012bef8240c8d3397c7b780':
OpenSSLEngine Impl: Fix bug where SSL Handshake never completes when using NPN.
commit cf557195a9b60d7f51a48500afde38481ddbc91c
Merge: cbbd7d1 986aeb7
Author: Kenny Root <kroot@android.com>
Date: Wed Jul 16 21:41:12 2014 +0000
am 986aeb78: Merge "Various fixes in OpenSSLEngineImpl."
* commit '986aeb78e533540463daf1753e24840f75b25ce6':
Various fixes in OpenSSLEngineImpl.
commit e08f238580e8ee471012bef8240c8d3397c7b780
Author: Koushik Dutta <koushd@gmail.com>
Date: Tue Jul 15 22:40:23 2014 -0700
OpenSSLEngine Impl: Fix bug where SSL Handshake never completes when using NPN.
Change-Id: Idc78204b7077fb367b64e1867c807cd39f596f98
commit 7ac13e03a79d0c99d181b1a28b1b3699ba3d5739
Author: Alex Klyubin <klyubin@google.com>
Date: Wed Jul 16 08:33:02 2014 -0700
Improve the Javadoc of PSKKeyManager.
This clarifies several points and adds sample code.
Bug: 15073623
Change-Id: I6e8aadc52277e238a998d6cee36795dab1151d58
commit 986aeb78e533540463daf1753e24840f75b25ce6
Merge: 8f9ac1a bdfcc18
Author: Kenny Root <kroot@android.com>
Date: Wed Jul 16 21:15:30 2014 +0000
Merge "Various fixes in OpenSSLEngineImpl."
commit bdfcc189efe41a3f812aeb55ea634bace67d159a
Author: Koushik Dutta <koushd@gmail.com>
Date: Sat Jun 28 19:19:21 2014 -0700
Various fixes in OpenSSLEngineImpl.
Fix "Buffers were not large enough" exception by directly using the
destination buffers.
Corrections around bytesProduced and bytesConsumed behavior.
Return BUFFER_OVERFLOW if a zero length destination is provided to
unwrap.
Change-Id: I1f1e9b72cd6968ed4f3c3c0edccbccebc33d6790
commit cbbd7d10e8e484c44a78e5b27e8fecda195f1692
Merge: ec7f8e6 fdb7d8c
Author: Alex Klyubin <klyubin@google.com>
Date: Tue Jul 15 18:49:14 2014 +0000
am fdb7d8c5: Enable PSK cipher suites when PSKKeyManager is provided.
* commit 'fdb7d8c53dabac5551e2499d045ba6829bcfc0a0':
Enable PSK cipher suites when PSKKeyManager is provided.
commit ec7f8e6b27330160f88540f4f2ace7bc2a0720a3
Merge: 5b8ccf1 8f9ac1a
Author: Alex Klyubin <klyubin@google.com>
Date: Tue Jul 15 15:53:46 2014 +0000
am 8f9ac1af: Enable PSK cipher suites when PSKKeyManager is provided.
* commit '8f9ac1af0cbdf00e5e47aee32c132522ebc3bd17':
Enable PSK cipher suites when PSKKeyManager is provided.
commit 5b8ccf1b09df6f35c1709bfc8fd727a291094a5b
Merge: 69a2e46 6e2315f
Author: Ed Heyl <edheyl@google.com>
Date: Tue Jul 15 13:34:25 2014 +0000
am 6e2315fd: reconcile aosp (e79c25bf33e10da41e489c537823f678e1a1169c) after branching. Please do not merge.
* commit '6e2315fd96c3c4a47450c1a437babacc94bc31a6':
reconcile aosp (e79c25bf33e10da41e489c537823f678e1a1169c) after branching. Please do not merge.
commit 084e3086be1d7a6b9280b64c7c8cdb7b41a13bea
Author: Kenny Root <kroot@google.com>
Date: Mon Jul 14 13:25:32 2014 -0700
Keep enough state to completely reset cipher instances
OpenSSL's RC4 mutates the given key. AES/CTR mutates the IV. We must
store these values locally to enable "doFinal" to cause the Cipher
instance to be reset to what it was right after "init".
Note that resetting and encrypting with the same key or IV breaks
semantic security.
Bug: 16298401
Bug: https://code.google.com/p/android/issues/detail?id=73339
Change-Id: Ie7e4dcb6cf6cc33ddad31d6b47066dc1b34e6894
commit 69a2e460cc0a40e1b951e400589b9932609079ec
Merge: 8b7bb32 bca895f
Author: David Benjamin <davidben@chromium.org>
Date: Mon Jul 14 18:17:28 2014 +0000
am bca895f8: Pass output buffer length into EVP_DigestSignFinal.
* commit 'bca895f809dd2cef7a0834f0bfeb2a06e42b277d':
Pass output buffer length into EVP_DigestSignFinal.
commit 8b7bb32af09a01e80442b70dd23e6997a937f103
Merge: a2404c9 e79c25b
Author: Kenny Root <kroot@google.com>
Date: Mon Jul 14 18:17:28 2014 +0000
am e79c25bf: Merge "DHKeyPairGenerator: use provided params"
* commit 'e79c25bf33e10da41e489c537823f678e1a1169c':
DHKeyPairGenerator: use provided params
commit 8f9ac1af0cbdf00e5e47aee32c132522ebc3bd17
Author: Alex Klyubin <klyubin@google.com>
Date: Thu Jun 19 13:37:24 2014 -0700
Enable PSK cipher suites when PSKKeyManager is provided.
This enables TLS-PSK cipher suites by default iff SSLContext is
initialized with a PSKKeyManager. For consistency, X.509 based
cipher suites are no longer enabled by default at all times -- they
are now only enabled by default iff SSLContext is initialized with a
X509KeyManager or a X509TrustManager.
When both X.509 and PSK cipher suites need to be enabled, PSK cipher
suites are given higher priority in the resulting list of cipher
suites. This is based on the assumption that in most cases users of
TLS/SSL who enable TLS-PSK would prefer TLS-PSK to be used when the
peer supports TLS-PSK.
Bug: 15073623
Change-Id: I8e2bc3e7a1ea8a986e468973b6bad19dc6b7bc3c
commit bca895f809dd2cef7a0834f0bfeb2a06e42b277d
Author: David Benjamin <davidben@chromium.org>
Date: Thu Jul 10 18:12:08 2014 -0400
Pass output buffer length into EVP_DigestSignFinal.
EVP_DigestSignFinal expects the input buffer length as *siglen on input. In
addition, if sigret is NULL, it returns the buffer size needed. Use this rather
than making assumptions about the EVP_PKEY used to initialize the EVP_MD_CTX.
commit e79c25bf33e10da41e489c537823f678e1a1169c
Merge: a328492 9b226f9
Author: Kenny Root <kroot@google.com>
Date: Fri Jul 11 16:46:23 2014 +0000
Merge "DHKeyPairGenerator: use provided params"
commit 9b226f90a992a4a2267b7a813e3b869851945c4d
Author: Kenny Root <kroot@google.com>
Date: Thu Jul 10 14:50:48 2014 -0700
DHKeyPairGenerator: use provided params
If the prime is provided in the DHParameterSpec, then use it to generate
the key.
Bug: 16188130
Change-Id: I42de02c71a58d691ef7ba6e2252367105687b758
Bug: 18388980
Change-Id: I853b02a32db113a5af3f6166e7d61fab58c3ff73
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 5a8ca5b1ebecbb48cd71e31df01bbe161d237fb2 |
|
27-Aug-2014 |
Kenny Root <kroot@google.com> |
No need to select NPN protocols when not enabled
Bug: 16957575
Change-Id: I351316a62f9b583b37b54f3e7fbfaa0450439ca4
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| a20d871a327ac3a0322b1086dce36c420502b11e |
|
22-Jul-2014 |
Kenny Root <kroot@google.com> |
OpenSSLEngineImpl: reduce number of copies needed
When the ByteBuffer didn't line up exactly with the backing array, it
would allocate a new buffer to write into. Instead, add the ability for
OpenSSL to read at an offset in the given array so a copy isn't needed.
(cherry picked from commit 7ed0fae1906061766d0042e69ccba20e4a702bbe)
Change-Id: I149d3f94e4b5cbdc010df80439ae3300cbdc87a5
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 4b050b6fb06fbb804557eecc72cc4ff0e0277525 |
|
06-Aug-2014 |
Kenny Root <kroot@google.com> |
OpenSSLSocketImpl: Move state checks inside mutex
Checking the state of the connection is unreliable if SSL_read and
SSL_write are happening in another thread. Move the state checks inside
our application mutex so we don't run into another thread mutating the
state at the same time.
Bug: 15606096
(cherry picked from commit 0931d51c58b2dc2f612298f99fbf0fa6ed4c3706)
Change-Id: I151ecbc57278374007a56827a65295b4c9476732
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 6e2315fd96c3c4a47450c1a437babacc94bc31a6 |
|
15-Jul-2014 |
Ed Heyl <edheyl@google.com> |
reconcile aosp (e79c25bf33e10da41e489c537823f678e1a1169c) after branching. Please do not merge.
Change-Id: I39ab275cd9744ba442fee7db9038107b4603526f
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 69c36470f6223ab60a606fa993860f9369adc329 |
|
13-Jun-2014 |
Alex Klyubin <klyubin@google.com> |
Use the new version of TLS Channel ID extension.
Bug: 14083889
Change-Id: I5fe0a1558184d44eb8a24bd92c0e7517937f3a5c
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| e66dbe5ad60417a4a9bf5ddf0bc3eb02652e43c8 |
|
10-Jun-2014 |
Justin Morey <jmorey@google.com> |
Add support for a Google Play Services version of the JNI lib
Change-Id: Ie0d9f83e366c0b99994eb861ae567d454cbbea5b
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 1b60d4ff4dc301b46f4ac8a48dc63da0be113a05 |
|
11-Jun-2014 |
Ian Rogers <irogers@google.com> |
Fix 64-bit build error.
Change-Id: I7ff48af2991fc03811c7874a974b9052934d27ae
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| f24ba0620d88b7d71ddb089b97d29fb1b073718d |
|
09-Jun-2014 |
Kenny Root <kroot@google.com> |
Add ability to wrap platform keys
This is mostly useful for unbundled Conscrypt currently when working
with KeyChain-based keys, but could be good for use with PKCS11-like
keys in other JSSE providers.
Bug: 15469749
Change-Id: I56bf2eaf3228bdf42d671437f4fffdafb8b47b12
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| fee2d0f1c55ffcb436ecc23af54bf7863a44ab8f |
|
04-Jun-2014 |
Kenny Root <kroot@google.com> |
Add more debugging for getting methods
When JNI registration fails, we should log it immediately to help
with debugging. Otherwise, it will tell you that you called a JNI
function with an exception pending.
Change-Id: I7cbba4d6639265a79a9d043d120f1a2bf72a85f7
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 4ccb72fd16c6c8d4b43a556595abee25d58f5cf1 |
|
30-May-2014 |
Kenny Root <kroot@google.com> |
Unbundle conscrypt
Don't build the host JNI library in an unbundled build since it's only
needed for testing currently.
Change-Id: I6b6003e86d9f6ff2d87431f156f4984f56592791
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 01cce891dd313a0fb9d4694283f2a13fb5c43afe |
|
09-May-2014 |
Alex Klyubin <klyubin@google.com> |
Expose support for TLS-PSK.
TLS-PSK (Pre-Shared Key) is a set of TLS/SSL cipher suites that use
symmetric (pre-shared) keys for mutual authentication of peers. These
cipher suites are in some scenarios more suitable than those based on
public key cryptography and X.509. See RFC 4279 (Pre-Shared Key
Ciphersuites for Transport Layer Security (TLS)) for more information.
OpenSSL currently supports only the following PSK cipher suites:
* TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
* TLS_PSK_WITH_3DES_EDE_CBC_SHA
* TLS_PSK_WITH_AES_128_CBC_SHA
* TLS_PSK_WITH_AES_256_CBC_SHA
* TLS_PSK_WITH_RC4_128_SHA
The last four cipher suites mutually authenticate the peers and
secure the connection using a pre-shared symmetric key. These cipher
suites do not provide Forward Secrecy -- once the pre-shared key is
compromised, all previous communications secured with that key can be
decrypted. The first two cipher suites combine the pre-shared
symmetric key with an ephemeral key obtained from an ECDH key
exchange performed during the TLS/SSL handshake, thus providing
Forward Secrecy.
Users of TLS-PSK are expected to provide an implementation of
PSKKeyManager to SSLContext.init and then enable at least one PSK
cipher suite in SSLSocket/SSLEngine.
Bug: 15073623
Change-Id: I8e59264455f980f23a5e66099c27b5b4d932b9bb
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 3e46e4ee56c8e37158f46941dedd5b436d724baa |
|
23-May-2014 |
Kenny Root <kroot@google.com> |
Unbundle: hacks to let Conscrypt compile standalone
This is the first pass at getting Conscrypt to compile standalone. It
works fine in apps currently. There are a few TODOs to fix.
Change-Id: I9b43ba12c55e04c8897ccacf38979ca671a55a26
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 81c666781f8e24242e997e2666b656b240c5a145 |
|
19-May-2014 |
Kenny Root <kroot@google.com> |
NativeCryptoTest: fix shutdown test
These weren't actually testing that the exceptions were thrown before.
Since we actually throw now, make sure we're throwing the expected
exception type.
Change-Id: I57b11492118dd7c04faa57c58de7b023294b179c
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 3f8d64078d49672f6301661baa59d24f1d2b74c0 |
|
14-May-2014 |
Marcus Oakland <marcus.oakland@arm.com> |
Fix of native crash in the evpUpdate method
The org.apache.harmony.security.tests.java.security.MessageDigest1Test
CTS test class's testSHAProvider method was causing a SIGSEGV when
"md.update(bytes, 1, -1);" was called, as the evpUpdate method was not
checking for the inLength parameter being negative. This has been
rectified and the test now passes.
Bug: 14821275
Change-Id: I94489a518f7a2d4a6e84e58f91d8eee6f0ceb045
Signed-off-by: Marcus Oakland <marcus.oakland@arm.com>
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| e526e75cfe12c2908d37b03562ac48a5bbefdf11 |
|
14-May-2014 |
Kenny Root <kroot@google.com> |
DH keys: derive public key if not available
Also make the params mutex when we're inflating from a serial object
since it will be null otherwise.
Change-Id: I36641725161c0a708ba303500acca368b0511abe
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 68a3f229cd71c1367173ebc31e5363293b9b5dbc |
|
13-May-2014 |
Kenny Root <kroot@google.com> |
SSL: also allow calls to read/write after cutthrough
Also add test to make sure this works.
Bug: 14832989
Change-Id: I046111cdcc4086a7104d462696078a767e86b12c
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| f43a94ff4594a859ed9beeb98650e0444a26973b |
|
12-May-2014 |
Kenny Root <kroot@google.com> |
Check for renegotiate_pending for tests
Tests call SSL_renegotiate to force a renegotiation, but was relying on
AppData being unset in this function. Instead we check that both
SSL_is_init_finished is false and SSL_renegotiation_pending is false.
Renegotiation is handled by SSL_write implicitly instead of explicitly
like the wrapper around SSL_do_handshake does.
Change-Id: I7e761afa718503933334cc19fbc696d714eca500
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 7b27ca77c328e510a165712a497c20b67c68e8a3 |
|
08-May-2014 |
Kenny Root <kroot@google.com> |
Add DH keys
Add the initial steps for DH keys to be generated and handled via
OpenSSL. Next steps will be hooking it up via other APIs that use DH
keys.
Change-Id: Ib159e60db73f82b75e0ba375a1d165c51286edac
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| dd284653f17d5801c8222f1368f1241eb428b7f2 |
|
07-May-2014 |
Kenny Root <kroot@google.com> |
SSLSocket: restore previous pre-handshake behavior
Before AppData was created in the initial handshake, calling SSL_read or
SSL_write would have a NULL appData field. This caused an exception to
be thrown. Now we have to check to make sure the handshake completed
before we continue on with SSL_read and SSL_write.
Change-Id: I969577cf56f61858450a7981a5196f58a6502968
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 64f361d8ce4c961d9339d6933de33a937b542db5 |
|
02-May-2014 |
Kenny Root <kroot@google.com> |
BIO_Stream: check for pending exception
OpenSSL may make several callbacks in a row, so we need to check whether
a pending exception is in flight before calling into the JVM again.
Bug: 14477174
Change-Id: I104fa0af08a229430e193c7ed7b147d115215cd2
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 798f9441e02b2f924bacee81af8c7ddc7c32482d |
|
11-Apr-2014 |
Neil Fuller <nfuller@google.com> |
Changes to support asynchronous close interruption
This change contains fixes to conscrypt from libcore change
I37de3e7d1a005a73821221e6156d10b95c595d7a
Bug: 13927110
Change-Id: Ied42e930e32013f93415625968372d3b997bd539
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| de9b58607d31660ccc2bbc3082a288c005764da0 |
|
22-Apr-2014 |
Kenny Root <kroot@google.com> |
Make AppData creation symmetric
AppData was being created in SSL_do_handshake, but freed in SSL_free.
Make it symmetric by creating AppData in SSL_new instead.
The SSLEngine may call do_handshake multiple times to complete a
handshake, but this was creating an AppData each time it entered.
Creating in SSL_new avoids the problem of checking whether it was
already created on each entry into SSL_do_handshake calls.
Bug: 14247219
Change-Id: I825486798250998a4d4141201bda68a4dffe13a4
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| f878e438660d93f8689b864165230492e7a412d4 |
|
08-Nov-2013 |
Kenny Root <kroot@google.com> |
Add OpenSSLEngineImpl
Add support for SSLEngine via OpenSSL APIs. Currently this supports just
the basic SSLEngine functionality. It can be improved in efficiency and
performance, but it appears not to leak anything and be correct
according to our test suites.
Change-Id: Iea2dc3922e7c30e26daca38361877bd2f88ae668
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 19fdf1af6bada9ebf4820839780d8713ac3824fa |
|
10-Apr-2014 |
Kenny Root <kroot@google.com> |
Convert calls to BIO_free to BIO_free_all
If we have a chain of BIO, we want to free the entire chain. Otherwise,
we might accidentally leave references sitting around. This shouldn't
matter for our current use-case, but might help in the future.
Change-Id: I586937629e1e4f2e80b5feefe2f49a85e8a31d31
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| f8a9b546d57c4731805e73e1e96ff2fb3e77d6e0 |
|
31-Mar-2014 |
Kenny Root <kroot@google.com> |
ALPN: change socket calls to SSL_set_alpn_protos
Calling SSL_CTX_set_alpn_protos appears to be detrimental to thread
safety since the implementation of it resets the values. It's not
idempotent to call it multiple times like SSL_CTX_enable_npn.
Bug: https://code.google.com/p/android/issues/detail?id=67940
Change-Id: I09ed9e75d08528300b86201c3e847b26702d4284
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 93cfc3c90ab19944ef1ac530dd844dfb64dce8f7 |
|
01-Apr-2014 |
Kenny Root <kroot@google.com> |
Check read and write from correct BIO
This happened to work before since SSL_set_fd sets both the read and
write BIO to the same value, but using different BIOs for the new
SSLEngine code will change this.
Change-Id: Ieebe31b1cda24325abf3af35c116549d33ac15d5
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| acc950a746dc75174d473eef4ec7434c71cd6d39 |
|
26-Mar-2014 |
Kenny Root <kroot@google.com> |
Add JNI_TRACE_MD to cut down on noise
During start-up of vogar, it does thousands of digests on the input
class files which makes the output really noisy. Since debugging MD
stuff is uncommon, just hide it behind another debug flag.
Change-Id: I972a1b61c6ffe2d4cc345b089f0be10751ea32e4
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| a0c196d76f1ed4fddeb94873b9aef47e50059cf2 |
|
26-Mar-2014 |
Kenny Root <kroot@google.com> |
Throw SSLHandshakeException for errors during handshake
This is a subclass of SSLHandshake, so it's not technically any
different, but more sophisticated clients use this to differentiate
between a failure during handshake and a general SSL failure.
Bug: 13130968
Change-Id: Ifad026c9af6748c1f7cb6a75f8f49aa3e75deea8
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| d2cced8b10f5e4f600a5eb9464eba0da7c8f09de |
|
20-Mar-2014 |
Kenny Root <kroot@google.com> |
Use the new endpointVerificationAlgorithm API
Use the new X509ExtendedTrustManager and use the new
getEndpointVerificationAlgorithm to check the hostname during the
handshake.
Bug: 13103812
Change-Id: Id0a74d4ef21a7d7c90357a111f99b09971e535d0
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 02fb0575e69baf7e1bf58508e6a01a202f6d0524 |
|
21-Mar-2014 |
Kenny Root <kroot@google.com> |
Allow verification failures to send SSL alert
Before we were relying on our pending exception to abort the SSL
handshake, but the SSL alert was not sent to the server. This enables
peer verification in the OpenSSL to send the alerts and cut the
handshake off earlier.
In OpenSSL, the ssl/s3_clnt.c had code that only sent an alert if verify
mode was not SSL_VERIFY_NONE. Since we're handling all the verification
during the callback, we can special case anything we want to do for
anonymous ciphers in the callback.
Change-Id: I6c8fd0d0c6402e29ef3cb5fc5156eef2f4191ff0
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 2a5460fc2ab3453b54d3f6b01f6c83dc7502fbdc |
|
10-Mar-2014 |
Kenny Root <kroot@google.com> |
Use non-pointer type on assign
Change-Id: I6260ddb06cd94e9fe1be3db0d9196c035884ecd6
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| fc7924bc78afc46c3c75722a735fe4db65c33304 |
|
10-Mar-2014 |
Kenny Root <kroot@google.com> |
Return SSL_TLSEXT_ERR_NOACK with no NPN/ALPN
We were returning SSL_TLSEXT_ERR_OK even if we did not select any
NPN/ALPN support.
Bug: https://code.google.com/p/android/issues/detail?id=66562
Change-Id: I79ea821512f03f1391247d3bcfc7ac7d042ecb41
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 88758d462641e4d2e72d26e55c270bfac97f3b08 |
|
27-Feb-2014 |
Kévin PETIT <kevin.petit@arm.com> |
Fix LP64 builds
The last parameter to EVP_DigestUpdate is a size_t which on LP64
platforms doesn't have the same size as unsigned int. Fix the type
of the update_func function pointer accordingly.
Change-Id: Idd3b544e479e05055bffb0470a4ef370fad984fe
Signed-off-by: Kévin PETIT <kevin.petit@arm.com>
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 652ff53bd48ed61389337a42d8e50cdb7ace0fec |
|
24-Feb-2014 |
Kenny Root <kroot@google.com> |
Fix up concurrent use of APIs
Code that is incorrectly using MessageDigest, Signature, or Mac in
multiple threads simultaneously could cause a SEGV if OpenSSL is
clearing out the MD_CTX at the same time another thread is trying to
write to it. Make sure we initialize a new MD_CTX after each run to
avoid crashing. The program using the instances concurrently is still
wrong and will most likely get inconsistent results.
Switch to using a context object instance to make sure we can hold a
reference to the object during the native call.
Bug: 8787753
Change-Id: I2518613a47cf03c811a29d17040804fc708394dd
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| ca8521342b2b2269fb2cd31b3c81cf3d49c3f6ba |
|
24-Feb-2014 |
Kenny Root <kroot@google.com> |
Throw ArrayIndexOutOfBoundsException instead of generic
This exception is specifically for arrays which is what we're dealing
with here.
Change-Id: I11be2c75019844701b305240152815d7c610fbef
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 60f83802801e224b51afac6c27c19e7c3d65ddc3 |
|
04-Feb-2014 |
Alex Klyubin <klyubin@google.com> |
Harden (EC)DSA signatures against weak nonces.
Private key information is leaked by (EC)DSA signatures when nonces
are produced by a weak RNG. This CL enables a mitigation provided by
OpenSSL: mix in private key and message being signed into randomly
generated nonce. Provided private key was generated by strong RNG,
this should mitigate the weakness.
NOTE: This mitigation is not implemented for signatures which use
hardware-backed private keys (AndroidKeyStore).
Change-Id: I60dbf57bff3cfcdcbbeb18be5d9dfba523cc6bb8
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 7c2b4ae9455185974ffe5ec1804c8980fe429635 |
|
13-Feb-2014 |
Alex Klyubin <klyubin@google.com> |
Throw instead of segfaulting when NULL EVP_PKEY encountered.
Change-Id: Idba6702dd43e541b51c990fc3440a17351e6def9
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 3bcae05d3e7d33e19f0e506ce6310570e44f63d5 |
|
05-Feb-2014 |
Kenny Root <kroot@google.com> |
Add extra debug statement in NativeCrypto
Need to track the output of X509_get_pubkey
Change-Id: I2196edbe935c32eabce840556958af67abfc1980
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 5b1934c717914323ddb0395f549ae11075a587da |
|
01-Feb-2014 |
Kenny Root <kroot@google.com> |
NativeCrypto: Handle 0-byte bignum arrays
Some DSA tests were calling with bignum arrays that had the high bit set
indicating a negative number.
Also an empty array was being passed as another part of the test. This
was working, but it was reading one byte past the end of the buffer.
Change-Id: Ibd5a0dce61703ea569fd483f8acf66fd149703f8
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 1744cf2b54cc7183ff83a3a2eab3a92a8d95ff55 |
|
30-Jan-2014 |
Kenny Root <kroot@google.com> |
BIGNUM convert to Java BigInteger
Java BigInteger is in two's complement, so it needs conversion for
negative numbers. We were mishandling it before and the previous change
just hacked around it. Actually convert to two's complement instead.
Change-Id: I6bfe9577f0936678476193b55433b7d7dbc04400
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 7dd8d0b433cf8212538aaaf8726f5222abf035dd |
|
09-Dec-2013 |
Matteo Franchin <matteo.franchin@arm.com> |
AArch64: Use long for pointers in Java sources.
Fixing some mistakes in the JNI signatures: some pointers were passed
via jint rather than jlong.
Change-Id: I6120cc5742c8429a9e0fddda715b5169d820d31a
Signed-off-by: Marcus Oakland <marcus.oakland@arm.com>
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| caceea78cf2f9b65bf7adc7f26ac6fd163a7f709 |
|
06-Dec-2013 |
Kenny Root <kroot@google.com> |
Add const modifier to evp_md
Dogmatic adherence to types.
Change-Id: Iab635a9963de086f7f4d1cc5678c1a7bcef5b0c4
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 2d089e18deae231149737cad6ce00f1e137a7199 |
|
21-Nov-2013 |
Alex Klyubin <klyubin@google.com> |
Stop depending on CipherSuite in OpenSSL-backed sockets.
This is in preparation for removing Harmony-backed TLS/SSL
implementations.
Change-Id: Ic108e16d086fb99b69f0a4e4faeb816dc50a7643
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| df32037861e5de1155d4b4070a8ddf649490f363 |
|
08-Nov-2013 |
Kenny Root <kroot@google.com> |
OpenSSLSocketImpl: remove unused fdObject
Looks like the use of this was removed in commit
90ed0ad55227df7a127054b25a43dbb6f6265a4b.
Change-Id: I65a3d7ac4129a2f1543b424cf72c754fc994cc21
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 11ac10be41fa98c695c984ad30f10321db9da44c |
|
18-Oct-2013 |
Kenny Root <kroot@google.com> |
Free EVP_CIPHER_CTX objects
Calling EVP_CIPHER_CTX_cleanup doesn't actually free the object. We need
to call EVP_CIPHER_CTX_free instead.
Change-Id: I716f4feaee446d47bd78852b18cff3bbe43fb1b1
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| e75878c72b717696d7e4f6cc1052f1cdaca3bda8 |
|
24-May-2013 |
Anwar Ghuloum <anwarg@google.com> |
Fix mac build
move #pragma gcc outside of functions for apple's ancient gcc
(cherry picked from commit 37f25af685a795b2f2bfa9abb8bb5109c422c52c)
Change-Id: I3ea7fa22805980cfd5059e75c21e2e943604fb8a
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 0e9746b7b132058651155b33f219c7789997985b |
|
13-Sep-2013 |
Kenny Root <kroot@google.com> |
Conscrypt: use certificate references in SSL code
Instead of marshalling and unmarshalling to ASN.1 DER, just use
references to OpenSSL X509 objects everywhere applicable.
Change-Id: I1a28ae9232091ee199a9d4c7cd3c7bbd1efa1ca4
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 1d5c92f74e14a4dd194cb6ad90a686e584da18ca |
|
12-Sep-2013 |
Kenny Root <kroot@google.com> |
Add specific exception for wrong final block length
EVP_DecryptFinal_ex can have an error on the wrong block length at the
end of a decrypted block, so throw IllegalBlockSizeException when that
happens instead of a RuntimeException.
Bug: 10610957
Bug: https://code.google.com/p/android/issues/detail?id=58396
Change-Id: I70ea040c3b52fc30591963270850871a8cc581d3
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 3f61f6e835a8c0d609bd5e524b302d972d0e8aff |
|
12-Sep-2013 |
Kenny Root <kroot@google.com> |
Merge "Conscrypt: remove dependence on stlport"
|
| 74f1a2a530135e47baf65bfce86d9a518f53911c |
|
12-Sep-2013 |
Kenny Root <kroot@google.com> |
Conscrypt: remove dependence on stlport
This helps with unbundling of Conscrypt by not forcing the app to
include a static version of stlport in their program.
Change-Id: I5bd17213059b8ae4d8d86921d82b43465253a62f
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 33bad173bc21cc7c057ef9e8f6e7df16ce1caa50 |
|
10-Sep-2013 |
Ruben Brunk <rubenbrunk@google.com> |
Remove dependency on JNIHelp header side effects.
(cherrypick of cc5305a004afc334842a4afadca9530c2ea0c8ff.)
Bug: 10680559
Change-Id: I49ad58dea61a0e558bebfbd76019e7e0730cab52
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| c58a18688cd17654a3f1c15f604d69c5ef78da22 |
|
11-Sep-2013 |
Kenny Root <kroot@google.com> |
Properly refcount X509 instances
We were leaking X509 references from stacks before so we could get away
with reusing references that should have been freed. Since we're properly
tracking references now, we need to up the reference of things we're
using.
(cherry picked from commit 499f7cd642cc32f89f793fe356afbebeba8bf9c1)
Bug: 10610037
Change-Id: I4a4beda9b635881c51194410a6da8274c3c1d429
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 8c51e39b2d31431be1c05a2f145a2cdf829d7978 |
|
10-Sep-2013 |
Kenny Root <kroot@google.com> |
Use sk_FOO_pop_free instead of sk_FOO_free
The proper way to free a stack of owned "FOO" items is to use
sk_FOO_pop_free since that will iterate through all the FOO instances
in the stack and free them. Calling sk_FOO_free just frees the stack and
not the items.
(cherry picked from commit 64299318644c0c6b86992d414e68d0af236b52c5)
Bug: 10610037
Bug: http://code.google.com/p/android/issues/detail?id=59536
Change-Id: I8af603b10219acb476666e77cc776b6936a19f8d
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| eaeedc318b5fba9995fc64d15341017ec182fe4c |
|
29-Aug-2013 |
Kenny Root <kroot@google.com> |
Move conscrypt out libjavacore and split tests
To make the situation with testing a little better and enable building
core libraries totally independent of conscrypt, move the native
registration to a JNI_OnLoad scheme. Also, since we want to separate the
testing, make conscrypt build its own tests library.
Change-Id: I9f2831839059c1c012ec7bdeab2f90b4e2f44bfd
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| fb822aec371f01db8c7d0d824901dd8487dd543c |
|
20-Aug-2013 |
Elliott Hughes <enh@google.com> |
Fix BIO_OutputStream::write to return the correct length.
This was leaving bad OpenSSL error states lying around for later
innocent calls to trip over.
Also clean up some of the other error reporting/handling.
Bug: 9822466
Bug: 10344304
Change-Id: I9e6d6fd9a6c5e466336217b47f45c211aff5555d
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 1e8948a5167623569a988457ae9b0888c1d0754a |
|
13-Aug-2013 |
Elliott Hughes <enh@google.com> |
Move libcore to C++11.
Change-Id: I1942be8f7cef51265d53272f36a217e88bfede94
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| ab3c653541a6fa0eaa38ba56a485afb6c5122cbb |
|
31-Jul-2013 |
Elliott Hughes <enh@google.com> |
Fix libcore's NativeCode.mk so we actually compile with -Werror.
Change-Id: Ib665ea7c6f54e43851bc04f0265e65218407c70f
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 6fcf0cbeec79d1f2491d8d0774fdb314fc419ba3 |
|
25-Jun-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: Add ALPN support
This adds the ability to use Application-Layer Protocol Negotiation
(ALPN) as both a client and a server. ALPN is essentially like Next
Protocol Negotiation (NPN) but negotiation is done in the clear. This
allows the use of other protocols on the same port (e.g., SPDY instead
of HTTP on port 80).
Although previously clients using NPN were able to use cut-through, the
new ALPN API does not provide for a way for a client to enable that
during a callback. So the only difference is that NPN clients can enable
SSL False Start while ALPN clients cannot currently.
Change-Id: I42ff70f3711e9cccaf754d189f76eeaa9db5f981
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 38f3d465ca25edad129ffdf71c61daf20a555920 |
|
06-Jun-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: handle X.509 serial number 0
There is no need to try to convert numbers that are of zero length
because they'll be zero anyway. Returning NULL in this instance caused a
crash in X.509 code since it immediately tried to pass it to BigInteger
which through a NullPointerException.
Bug: 9297758
Change-Id: I719ca7b8f086937ee25094bfe981987def855744
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| db88d0510b89bab4c3ca13a62ae0e737cab48d58 |
|
05-Jun-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: free error state on client_cb
On a call to SSL_get_certificate() there appears to be one path that
will set an error code (SSL_aANON) and returns NULL. This client_cb
wasn't expecting NULL to be an error.
To avoid the error from lingering and showing up in later tests, clear
it so the later tests have more accurate errors.
Bug: 9198763
Change-Id: I229c06fce042436a8545812c1d48c1210408d57e
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| f59f49f5ccb4b5053a5badc19256ea698db34573 |
|
29-May-2013 |
Kenny Root <kroot@google.com> |
Merge "NativeCrypto: check that npnProtocols != NULL"
|
| fbbcca5d07c2287fba22f31003e7a26c78fe02ba |
|
29-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: check that npnProtocols != NULL
There appears to be a path where an application can not specify which
NPN protocols it supports but can request that it is negotiated. Match
the advertise method by checking that we have NPN methods set before
using them in a call back to OpenSSL.
Bug: 9186885
Change-Id: I1f35d45709f264d6e2f0c7fef316cb6d93db4ed1
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| a084cc798e7d3c7aef917938db3b861c6beecff1 |
|
29-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: change debug format string to "%.*s"
This ensures the string stops at the right place instead of running off
the end of the buffer. This still doesn't help much for binary data.
Change-Id: Ia56b07a586d8f55ebb0d4237f6d598b307f065fe
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| bcdb80d2bc818d5c6ec93aae44f70a77136c13c4 |
|
28-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: add debug option for SSL streams
Print out the key in format suitable for Wireshark decrypting. To use
this, see the comments next to the newly-defined flags.
Wireshark 1.6 that comes with Ubuntu seems to be broken. Wireshark 1.8
works.
Change-Id: Ifd6d75f03f76068085cec0620b465793c2d60587
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 35beb3047b2b8ffc019f8218989a0255cc5e3818 |
|
06-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: replace Harmony routines with OpenSSL
Change-Id: I954932e45877cca073b71f33b4ccd4eacae8f510
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| a2b8878f8089af75de8e1c4dda654e29b0e72eff |
|
03-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: exit early when ssl_session is null
to_SSL_SESSION already throws NPE, so we should exit early. Otherwise
we'll throw another NPE needlessly.
Change-Id: I664340485e0b6335dc1ff7cca5343205894bc2fc
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 1ecc0481f90d32b89b3b051cad70efe07468acd0 |
|
03-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: move key conversion to Java
Key type conversion in native code is from the legacy period before the
OpenSSLKey class existed. Use that to hold PKEY reference instead of
converting it in native code.
Change-Id: I84e9a6e1f2e0f95d2f44c18fa9f65cd15e039d63
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 923e3c5a80a6daefc14d4d0242ac46f23ac41b6a |
|
01-May-2013 |
Kenny Root <kroot@google.com> |
NativeCrypto: build native library standalone
Change-Id: I678f5c1b985d72ab1d41ae22dfcae35814c44e85
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|
| 860d2707ce126ef8f66e3eac7ceeab6d24218cd8 |
|
24-Apr-2013 |
Kenny Root <kroot@google.com> |
Move JSSE to new package
To help with shipping the JSSE with apps that want to bundle it, move
it to a new package so that the tangles in other parts of the library
can be untangled.
Change-Id: I810b6861388635301e28aee5b9b47b8e6b35b430
/external/conscrypt/src/main/native/org_conscrypt_NativeCrypto.cpp
|