openbsd, branch libressl-v2.9.1

This commit was manufactured by cvs2git to create branch 'OPENBSD_6_5'.

2019-04-10T16:23:57+00:00

Avoid an overread caused by d2i_PrivateKey().

2019-04-10T16:23:55+00:00

There are cases where the old_priv_decode() function can fail but consume bytes. This will result in the pp pointer being advanced, which causes d2i_PKCS8_PRIV_KEY_INFO() to be called with an advanced pointer and incorrect length. Fixes oss-fuzz #13803 and #14142. ok deraadt@ tb@

Recommend SSL_CTX_add1_chain_cert(3) rather than

2019-04-09T22:01:50+00:00

SSL_CTX_add_extra_chain_cert(3). From Dr. Stephen Henson via OpenSSL commit a4339ea3 Jan 3 22:38:03 2014 +0000 which is still under a free license.

Document SSL_CTX_clear_mode(3) and SSL_clear_mode(3).

2019-04-09T21:06:31+00:00

From Kurt Roeckx via OpenSSL commit 57fd5170 May 13 11:24:11 2018 +0200 which is still under a free license. While here, polish awkward wording and reduce duplication.

exitting -> exiting

2019-04-07T16:41:16+00:00

From Michael Scovetta, PR #108

Revert tasn_prn.c r1.18.

2019-04-07T16:35:50+00:00

In this code, just because something is cast to a type doesn't mean it is necessarily that type - in this case we cannot check the length of the ASN1_STRING here, since it might be another data type and later handled as an int (for example, in the V_ASN1_BOOLEAN case). We will revisit this post release. ok tb@

whitespace consistency

2019-04-05T20:25:42+00:00

Add SERVER_HELLO_RETRY state

2019-04-05T20:25:25+00:00

By design, our state machine is a DAG contrary to the state machine in

2019-04-05T20:23:38+00:00

the spec. To avoid the obvious loop in the RFC's state machine, we added a CLIENT_HELLO_RETRY state which is a second ClientHello with special rules. There is, however, no state to react to this second client hello. This adds a matching SERVER_HELLO_RETRY state to the handshakes table. This means in particular that the WITH_HRR state cannot be set in tls13_server_hello_recv(), so remove this now dead check. ok jsing

Import SSL_CTX_add1_chain_cert(3) from OpenSSL branch 1.1.1, which is still

2019-04-05T18:29:43+00:00

under a free license, omitting functions we don't have and tweaked by me; the functions were provided by jsing@ in ssl.h rev. 1.166. While here, also document SSL_CTX_get_extra_chain_certs(3) because it is closely related to companion functions are already documented and the API is kind of incomplete without it.