A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2026-04-03T13:11:00+00:00 2026-04-03T13:11:00+00:00 jsing 2026-04-03T13:11:00+00:00 urn:sha1:9726691a1e7289634e04b2e44da815e69091af49 We no longer support TLSv1.0 and definitely do not support SSLv3 - remove the empty fragments workaround for the CBC vulnerability in these protocols. ok kenjiro@ tb@ 2026-04-03T07:17:36+00:00 jsing 2026-04-03T07:17:36+00:00 urn:sha1:34c9ebaffbf06ba9d8883c4adf8061fd670f54c4 This is a left over from when we accepted SSLv2 ClientHello messages. ok kenjiro@ 2024-02-03T15:58:34+00:00 beck 2024-02-03T15:58:34+00:00 urn:sha1:20afa90e552d2efed2187dbafc92170a3895e921 This version of GOST is old and not anywhere close to compliant with modern GOST standards. It is also very intrusive in libssl and makes a mess everywhere. Efforts to entice a suitably minded anyone to care about it have been unsuccessful. At this point it is probably best to remove this, and if someone ever showed up who truly needed a working version, it should be a clean implementation from scratch, and have it use something closer to the typical API in libcrypto so it would integrate less painfully here. This removes it from libssl in preparation for it's removal from libcrypto with a future major bump ok tb@ 2023-07-07T08:53:55+00:00 tb 2023-07-07T08:53:55+00:00 urn:sha1:dbef0411934bf7e6e34af43e231092c9d5a27b47 ok beck jsing 2022-11-26T16:08:57+00:00 tb 2022-11-26T16:08:57+00:00 urn:sha1:81d98bf600a381a625eb11b39a725b08c0ba547f Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook 2022-10-02T16:36:42+00:00 jsing 2022-10-02T16:36:42+00:00 urn:sha1:efde998d3821e41e124a4bfcdf103e506055fc52 These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@ 2022-10-01T16:23:15+00:00 jsing 2022-10-01T16:23:15+00:00 urn:sha1:ce780ee20f92c920e451f9c3bdd6bb5fe83f4c5b Currently, ssl_both.c contains several functions that are used by both the legacy client and legacy server. This interwines the client and server, making it harder to make progressive changes. While it does deduplicate some code, it also ends up with code that is conditioned on s->server and forces the caller to pass in SSL3_ST_* values. Move these functions from ssl_both.c into ssl_clnt.c and ssl_srvr.c, renaming as appropriate and removing the s->server conditionals. Also move the client and server function prototypes from ssl_locl.h into the .c files, making them static in the process. ok tb@ 2022-02-05T14:54:10+00:00 jsing 2022-02-05T14:54:10+00:00 urn:sha1:a463011117e88ea3125fb580b8c6c60d68722651 S3I has served us well, however now that libssl is fully opaque it is time to say goodbye. Aside from removing the calloc/free/memset, the rest is mechanical sed. ok inoguchi@ tb@ 2022-02-03T16:33:12+00:00 jsing 2022-02-03T16:33:12+00:00 urn:sha1:1797a334a41f2408c221e936472024878d34d7c6 Remove the X509 argument as it is unused - this was passed so that ssl_cert_type() can get the public key from the X509 object if the EVP_PKEY argument is NULL, however this is never the case. ok tb@ 2022-01-08T12:43:45+00:00 jsing 2022-01-08T12:43:45+00:00 urn:sha1:ffc409d6df877abea2cf56b17ccae8b4d3db2641 Nearly all structs in libssl start with an SSL_ suffix, rename CERT and CERT_PKEY for consistency. ok inoguchi@ tb@