A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-09-24T18:12:00+00:00 2020-09-24T18:12:00+00:00 jsing 2020-09-24T18:12:00+00:00 urn:sha1:10841ee643f560678ff5ed0276c4da735ec37bdf ok beck@ inoguchi@ tb@ 2020-09-24T17:59:54+00:00 jsing 2020-09-24T17:59:54+00:00 urn:sha1:1328e78055c6ad087ebbec8484862dea13576ef5 Provide a ssl3_release_buffer() function that correctly frees a buffer and call it from the appropriate locations. While here also change ssl3_release_{read,write}_buffer() to void since they cannot fail and no callers check the return value currently. ok beck@ inoguchi@ tb@ 2020-05-19T16:35:21+00:00 jsing 2020-05-19T16:35:21+00:00 urn:sha1:369bbcd163f15f6e452e14282f0a65dafde2f5ab Some time prior to SSLeay 0.8.1b, SSL_PKEY_RSA_SIGN got added with the intention of handling RSA sign only certificates... this incomplete code had the following comment: /* check to see if this is a signing only certificate */ /* EAY EAY EAY EAY */ And while the comment was removed in 2005, the incomplete RSA sign-only handling has remained ever since. Remove SSL_PKEY_RSA_SIGN and rename SSL_PKEY_RSA_ENC to SSL_PKEY_RSA. While here also remove the unused SSL_PKEY_DH_RSA. ok tb@ 2020-03-12T17:15:33+00:00 jsing 2020-03-12T17:15:33+00:00 urn:sha1:1ff32d7d2a793d3705647cf8a01469592503cf75 This reduces the chance of accidently leaking stack memory. ok inoguchi@ tb@ 2020-01-23T10:48:37+00:00 jsing 2020-01-23T10:48:37+00:00 urn:sha1:a0913f8b11765018808c519315bcbc52aa7a4f27 ssl_get_message is essentially a switch between ssl3_get_message and dtls1_get_message, both only used by the legacy stack. Instead, use SSL_IS_DTLS() in ssl3_get_message to call the DTLS function when necessary. ok beck@ inoguchi@ tb@ 2019-03-25T16:35:48+00:00 jsing 2019-03-25T16:35:48+00:00 urn:sha1:81bb5fac89e0630dea5eb48cdb42f20582e16a89 We will now include the certificates in the chain in the certificate list, or use the existing extra_certs if present. Failing that we fall back to the automatic chain building if not disabled. This also simplifies the code significantly. ok beck@ tb@ 2018-11-08T22:28:52+00:00 jsing 2018-11-08T22:28:52+00:00 urn:sha1:d1a7f20049bf29c61782397cffb632339b12ba54 This provides a cleaner, simpler and more readable API, with code that uses a BUF_MEM instead of a BIO. ok beck@ ("hurry up") and tb@. 2018-10-24T18:04:50+00:00 jsing 2018-10-24T18:04:50+00:00 urn:sha1:c35a1141f368eb454f165541c3dfbe6b6e48b91d In January 2017, we changed large amounts of libssl's data structures to be non-visible/internal, however intentionally left things that the software ecosystem was needing to use. The four or so applications that reached into libssl for record layer related state now implement alternative code. As such, make these data structures internal. ok tb@ 2018-08-24T17:30:32+00:00 jsing 2018-08-24T17:30:32+00:00 urn:sha1:dd7cee845ba455372d9339ef09b4c365da4166ac Now that all handshake messages are created using CBB, remove the non-CBB ssl3_handshake_msg_start()/ssl3_handshake_msg_finish() functions. Rename the CBB variants by dropping the _cbb suffix. ok bcook@ inoguchi@ tb@ 2017-10-08T16:24:02+00:00 jsing 2017-10-08T16:24:02+00:00 urn:sha1:ba9ebd2e46ba795dd4f082910e89df705f1e264b which allows us to drop dtls1_send_change_cipher_spec() entirely. ok inoguchi@