openbsd/src/lib/libcrypto/crypto, branch OPENBSD_6_0_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_6_0_BASE2016-06-30T12:19:51+00:00Tighten behavior of _rs_allocate failure for portable arc4random implementations.2016-06-30T12:19:51+00:00bcook2016-06-30T12:19:51+00:00urn:sha1:feaba99148498e3901e21567eef6244222c71431
In the event of a failure in _rs_allocate for rsx, we still have a reference to
freed memory for rs on return. Not a huge deal since we subsequently abort in
_rs_init, but it looks strange on its own.
ok deraadt@
Tighten behavior of _rs_allocate on Windows.2016-06-30T12:17:29+00:00bcook2016-06-30T12:17:29+00:00urn:sha1:04659cfbf6434208cea373c44b6482783a1a7299
For Windows, we are simply using calloc, which has two annoyances:
the memory has more permissions than needed by default, and it comes
from the process heap, which looks like a memory leak since this memory
is rightfully never freed.
This switches _rs_alloc on Windows to use VirtualAlloc, which restricts the
memory to READ|WRITE and keeps the memory out of the process heap.
ok deraadt@
remove hppa64 port, which we never got going beyond broken single users.2016-05-11T21:52:49+00:00deraadt2016-05-11T21:52:49+00:00urn:sha1:42135baa1d099815f06003af138c18bcef038202
hppa reverse-stack gives us a valuable test case, but most developers don't
have a 2nd one to proceed further with this.
ok kettenis
Crank majors for lib{crypto,ssl,tls} due to symbol removals, symbol2016-04-28T17:07:07+00:00jsing2016-04-28T17:07:07+00:00urn:sha1:643f50290d39864797888fc818170917b845775c
additions and functionality changes.
fix typo in comment; ok beck2016-04-19T20:20:24+00:00tj2016-04-19T20:20:24+00:00urn:sha1:86631535ec5e92d1d055ad8b03986f6dc52cc4d7Calling clone(2) with CLONE_NEWPID yields multiple processes with pid=1.2016-01-04T02:04:56+00:00bcook2016-01-04T02:04:56+00:00urn:sha1:0f894628446dec0db2f00dac168dac6bcb7dd705
Work around this particular case by reseeding whenever pid=1, but as guenther@
notes, directly calling clone(2), and then forking to match another pid,
provides other ways to bypass new process detection on Linux.
Hopefully at some point Linux implements something like MAP_INHERIT_ZERO, and
does not invent a corresponding mechanism to subvert it.
Noted by Sebastian Krahmer and the opmsg team.
See http://stealth.openwall.net/crypto/randup.c for a test program.
ok beck@
bump the major for libcrypto/ssl/tls for a CRYPTO_chacha_20 ABI change2015-12-09T14:11:03+00:00bcook2015-12-09T14:11:03+00:00urn:sha1:362a098a9defa7a18d8f5b3336d4810a11db94ec
ok jsing@, deraadt@, beck@
bump minors after adding EVP_aead_chacha20_poly1305_ietf()2015-11-02T15:41:59+00:00reyk2015-11-02T15:41:59+00:00urn:sha1:9b531b26eeeea735265af970dfaa4b2ecc207f35
OK jsing@
Stop supporing "legcay" time formats that OpenSSL supports. Rewrite the2015-10-19T16:32:37+00:00beck2015-10-19T16:32:37+00:00urn:sha1:6f20e3b7bc4e6801abfde111c397198fb23a59ec
utctime and gentime wrappers accordingly. Along with some other cleanup.
this also removes the need for timegm.
ok bcook@ sthen@ jsing@
Flense the greasy black guts of unreadble string parsing code out of three areas2015-10-02T15:04:45+00:00beck2015-10-02T15:04:45+00:00urn:sha1:0fdba47b730ef7a8d2107e42c5db7b2a3e008a8f
in asn1 and x509 code, all dealing with an ASN1_TIME. This brings the parsing
together in one function that converts into a struct tm. While we are at it this
also brings us into conformance with RFC 5280 for times allowed in an X509 cert,
as OpenSSL is very liberal with what it allows.
input and fixes from deraadt@ jsing@ guethther@ and others.
ok krw@, guenther@, jsing@