From 9add4e1001ce08d78c17e4a3d994fd805f872d2a Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Mon, 31 Aug 2015 16:28:14 +0200 Subject: Add support for set_tmp_dh() and RFC5114 DH parameters for forward secrecy. rust-openssl didn't support forward secrecy at all. This adds support for DHE, by exposing set_tmp_dh() as well as the RFC5114 parameters, which are conveniently exposed since OpenSSL 1.0.2. With OpenSSL >= 1.0.2, and the rfc5114 feature gate, enabling DHE is as simple as (here for 2048-bit MODP group with 256-bit prime order subgroup): use openssl::dh::DH; let dh = DH::get_2048_256().unwrap(); ctx.set_tmp_dh(dh).unwrap(); With OpenSSL < 1.0.2, DH::from_params() can be used to manually specify the DH parameters (here for 2048-bit MODP group with 256-bit prime order subgroup): use openssl::bn::BigNum; use openssl::dh::DH; let p = BigNum::from_hex_str("87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597").unwrap(); let g = BigNum::from_hex_str("3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659").unwrap(); let q = BigNum::from_hex_str("8CF83642A709A097B447997640129DA299B1A47D1EB3750BA308B0FE64F5FBD3").unwrap(); let dh = DH::from_params(p, g, q).unwrap(); ctx.set_tmp_dh(dh).unwrap(); --- openssl/Cargo.toml | 1 + 1 file changed, 1 insertion(+) (limited to 'openssl/Cargo.toml') diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml index c230aa04..660c24d5 100644 --- a/openssl/Cargo.toml +++ b/openssl/Cargo.toml @@ -19,6 +19,7 @@ aes_xts = ["openssl-sys/aes_xts"] aes_ctr = ["openssl-sys/aes_ctr"] npn = ["openssl-sys/npn"] alpn = ["openssl-sys/alpn"] +rfc5114 = ["openssl-sys/rfc5114"] [dependencies.openssl-sys] path = "../openssl-sys" -- cgit v1.2.3 From a91b6bf3bd216c13f0dafdbbf9ef33f15dd103bf Mon Sep 17 00:00:00 2001 From: Alex Crichton Date: Tue, 22 Sep 2015 11:29:47 -0700 Subject: Enable testing on Windows via AppVeyor This abolishes the test.sh script which spawns a bunch of `openssl` instances to instead run/manage the binary in-process (providing more isolation to boot). The tests have been updated accordingly and the `connected_socket` dependency was also dropped in favor of `net2` as it the former doesn't work on Windows. --- openssl/Cargo.toml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'openssl/Cargo.toml') diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml index 9d16ccd6..8ade8101 100644 --- a/openssl/Cargo.toml +++ b/openssl/Cargo.toml @@ -32,6 +32,4 @@ libc = "0.1" [dev-dependencies] rustc-serialize = "0.3" - -[dev-dependencies.connected_socket] -connected_socket = "0.0.1" +net2 = "0.2.13" -- cgit v1.2.3 From 28320a65a734b2b38301ef149746a44cb23cd366 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 1 Sep 2015 10:56:33 +0200 Subject: Add SSL::set_ecdh_auto() This sets automatic curve selection and enables ECDH support. Requires LibreSSL or OpenSSL >= 1.0.2, so behind a feature gate. --- openssl/Cargo.toml | 1 + 1 file changed, 1 insertion(+) (limited to 'openssl/Cargo.toml') diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml index 8ade8101..c70c3ad3 100644 --- a/openssl/Cargo.toml +++ b/openssl/Cargo.toml @@ -20,6 +20,7 @@ aes_ctr = ["openssl-sys/aes_ctr"] npn = ["openssl-sys/npn"] alpn = ["openssl-sys/alpn"] rfc5114 = ["openssl-sys/rfc5114"] +ecdh_auto = ["openssl-sys/ecdh_auto"] [dependencies.openssl-sys] path = "../openssl-sys" -- cgit v1.2.3 From 677ed6ad1b7a84b0ae96e722bd0a084c67bcff40 Mon Sep 17 00:00:00 2001 From: Steven Fackler Date: Mon, 5 Oct 2015 22:34:32 +0100 Subject: Release v0.6.6 --- openssl/Cargo.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'openssl/Cargo.toml') diff --git a/openssl/Cargo.toml b/openssl/Cargo.toml index c70c3ad3..ac0a5cc7 100644 --- a/openssl/Cargo.toml +++ b/openssl/Cargo.toml @@ -1,11 +1,11 @@ [package] name = "openssl" -version = "0.6.5" +version = "0.6.6" authors = ["Steven Fackler "] license = "Apache-2.0" description = "OpenSSL bindings" repository = "https://github.com/sfackler/rust-openssl" -documentation = "https://sfackler.github.io/rust-openssl/doc/v0.6.5/openssl" +documentation = "https://sfackler.github.io/rust-openssl/doc/v0.6.6/openssl" readme = "../README.md" keywords = ["crypto", "tls", "ssl", "dtls"] @@ -24,7 +24,7 @@ ecdh_auto = ["openssl-sys/ecdh_auto"] [dependencies.openssl-sys] path = "../openssl-sys" -version = "0.6.4" +version = "0.6.6" [dependencies] bitflags = ">= 0.2, < 0.4" -- cgit v1.2.3