openbsd/src/lib/libssl/s23_srvr.c, branch OPENBSD_5_7 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_5_7 2015-03-08T16:48:49+00:00 This commit was manufactured by cvs2git to create branch 'OPENBSD_5_7'. 2015-03-08T16:48:49+00:00 cvs2svn admin@example.com 2015-03-08T16:48:49+00:00 urn:sha1:03e0d0748934886665c3031cda5fdccf45f2fb8d Bring back the horrible API that is get_cipher_by_char/put_cipher_by_char. 2015-02-06T08:30:23+00:00 jsing 2015-02-06T08:30:23+00:00 urn:sha1:970e6ec5cda1aae85293f7a4c40abbf0d9bc7457 This API was intended to be an internal only, however like many things in OpenSSL, it is exposed externally and parts of the software ecosystem are now using it since there is no real alternative within the public API. ok doug@, tedu@ and reluctantly miod@ ssl3_init_finished_mac() calls BIO_new() which can fail since it in turn 2014-12-10T15:43:31+00:00 jsing 2014-12-10T15:43:31+00:00 urn:sha1:dab47bb742c4c69e7fbed8b439b68dd68e5a3bcc calls malloc(). Instead of silently continuing on failure, check the return value of BIO_new() and propagate failure back to the caller for appropriate handling. ok bcook@ Sort and group includes. 2014-11-16T14:12:47+00:00 jsing 2014-11-16T14:12:47+00:00 urn:sha1:dc16671f7b6b2455ac1577a735b7ef0a5d6bdacf Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes(). 2014-10-18T16:13:16+00:00 jsing 2014-10-18T16:13:16+00:00 urn:sha1:e5f7da89ad91edc7b49a86c9e81df055d649d6da arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@ Since we no longer need to support SSLv2-style cipher lists, start 2014-08-10T14:42:56+00:00 jsing 2014-08-10T14:42:56+00:00 urn:sha1:a900fde6b8efe7fd9b77b5a22dc1ef0cebe605a5 unravelling the maze of function pointers and callbacks by directly calling ssl3_{get,put}_cipher_by_char() and removing the ssl_{get,put}_cipher_by_char macros. Prompted by similar changes in boringssl. ok guenther. When you expect a function to return a particular value, don't put a comment 2014-08-07T19:46:31+00:00 miod 2014-08-07T19:46:31+00:00 urn:sha1:52fafe121652f8c5058ec964bbbf0d342db8037c saying that you expect it to return that value and compare it against zero because it is supposedly faster, for this leads to bugs (especially given the high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this library). Instead, compare for the exact value it ought to return upon success. ok deraadt@ Fix CVE-2014-3511; TLS downgrade, verbatim diff 2014-08-07T04:49:53+00:00 deraadt 2014-08-07T04:49:53+00:00 urn:sha1:d262467c46607aa30800e41ec750692ff8571476 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b ok guenther miod No need to keep ssl23_foo() flavours mapping to ssl3_foo(). 2014-07-11T08:17:36+00:00 miod 2014-07-11T08:17:36+00:00 urn:sha1:d9f6f668cd5c8449297f6be877ee548d757a6c1e ok tedu@ decompress libssl. ok beck jsing 2014-07-10T08:51:15+00:00 tedu 2014-07-10T08:51:15+00:00 urn:sha1:78de0a2c32aaba2455b28e3cb034f296c59c3179