openbsd/src/lib/libssl/ssl_local.h, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92026-04-03T13:11:00+00:00Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability.2026-04-03T13:11:00+00:00jsing2026-04-03T13:11:00+00:00urn:sha1:9726691a1e7289634e04b2e44da815e69091af49
We no longer support TLSv1.0 and definitely do not support SSLv3 - remove
the empty fragments workaround for the CBC vulnerability in these
protocols.
ok kenjiro@ tb@
Mop up mac_packet.2026-04-03T07:17:36+00:00jsing2026-04-03T07:17:36+00:00urn:sha1:34c9ebaffbf06ba9d8883c4adf8061fd670f54c4
This is a left over from when we accepted SSLv2 ClientHello messages.
ok kenjiro@
Hook up X25519MKLEM768 to the TLS 1.3 handshake2025-12-04T21:16:17+00:00beck2025-12-04T21:16:17+00:00urn:sha1:dccd1f43a0c2de3852d9515f57353d756629c97a
This does the following:
1) Adds a second key share prediction to the TLS 1.3 handshake.
We only add one as we are unlikely to want to send more than
one PQ one, and one classical one and are unlikely to waste
bytes on a second PQ algorithm (anything that wants something
else that we support can HRR to get it)
2) Adds X25519MLKEM768 (4588) to our list of supported groups.
We add this to our preferred client and server key shares for TLS 1.3
and we now have a separate list for TLS 1.2 which does not do this,
cleaning up the old "full list" from the comments.
3) Updates the golden magic numbers in the regression tests to allow
for the above two things changing the handshake, so the regress
tests pass.
With this you can successfully hybrid PQ with servers and clients
that support it.
ok tb@ kenjiro@
libssl: const correct the ssl_session_dup() helper2025-10-24T09:23:06+00:00tb2025-10-24T09:23:06+00:00urn:sha1:2e803cbe8e599c0ae52e9dda44c3d22e3dec105d
This allows a const correct SSL_SESSION_dup() implementation at the cost
of casting away const due to the const incorrect CRYPTO_dup_ex_data()...
(I should look into fixing that, but things like rust-openssl make that
hard at this point in the release cycle.)
ok kenjiro (as part of a larger diff)
ssl_local.h: stop guarding SYSerror() with an #ifdef2025-05-10T06:04:36+00:00tb2025-05-10T06:04:36+00:00urn:sha1:b733aacdb5dcda33418a7b15986531415bf773b5ssl_local: provide an SSL-internal version of SYSerror()2025-05-10T05:49:56+00:00tb2025-05-10T05:49:56+00:00urn:sha1:f1cb2042ed58c0f2125c881f6786e4e3580203e7ssl_local.h: adjust some whitespace2025-05-10T05:37:22+00:00tb2025-05-10T05:37:22+00:00urn:sha1:16f888a4602a11eeb495d5646e698e92f7833df5const correct SSL_error_internal()2025-05-10T05:31:21+00:00tb2025-05-10T05:31:21+00:00urn:sha1:aa69cf38fa78a51f2bec81aaaf721b3798c5e574Remove two unused defines, update standard reference2025-04-18T08:07:36+00:00tb2025-04-18T08:07:36+00:00urn:sha1:6caa24072745344bf8a53498a883e94c61273075
ok jsing
Fix annoying whitespace2025-04-18T07:34:01+00:00tb2025-04-18T07:34:01+00:00urn:sha1:1afbc22dbc8e6d4c3acfc0dfe953e57a700731ba