openbsd/src/lib/libssl/ssl_rsa.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2019-03-25T16:46:48+00:00 Rework ssl_ctx_use_certificate_chain_bio() to use the CERT_PKEY chain. 2019-03-25T16:46:48+00:00 jsing 2019-03-25T16:46:48+00:00 urn:sha1:efbbd2468336b87fa8f4dc802ec09d5638f8f0cb This means that any additional CA certificates end up on the per certificate chain, rather than the single/shared extra_certs. Also simplify this code and in particular, avoid setting the return value to indicate success until we've actually succeeded. ok beck@ tb@ Stop pretending that a cert member in a SSL and SSL_CTX can be NULL. 2018-11-08T20:55:18+00:00 jsing 2018-11-08T20:55:18+00:00 urn:sha1:c763627af1fbaca531b187d8fe0fc8c5eadfea85 ok beck@ tb@ OpenSSL started adding const to functions all over the place. Make all 2018-04-25T07:10:39+00:00 tb 2018-04-25T07:10:39+00:00 urn:sha1:0f0ad284bbc9b0a6be6f67a44e240303b6070796 our libssl functions match theirs wrt const, except for BIO_f_ssl(3) which will be fixed in a later step. this went through a i386 bulk by sthen ok jsing Change SSLerror() back to taking two args, with the first one being an SSL *. 2017-02-07T02:08:38+00:00 beck 2017-02-07T02:08:38+00:00 urn:sha1:9a5920738bea15430db1fdd138e67d9bbc3a95d3 Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible Finish the fallout of the SSLerr->SSLerror cleanup to get rid of the ugly 2017-01-26T12:16:13+00:00 beck 2017-01-26T12:16:13+00:00 urn:sha1:a141ed2bc17672028f4c648479f1cc3c598be1e9 line wraps that resulted Send the error function codes to rot in the depths of hell where they belong 2017-01-26T10:40:21+00:00 beck 2017-01-26T10:40:21+00:00 urn:sha1:a4abf558fd44464a5a48bfeb5393b01002f66c5e We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@ sk_pop_free() checks for NULL so do not bother doing it from the callers. 2017-01-24T14:57:31+00:00 jsing 2017-01-24T14:57:31+00:00 urn:sha1:66e0d0ee54e4c4af19fda4ee640663c25db4ff98 move default_passwd_cb and default_passwd_cb_userdata back into 2017-01-23T22:34:38+00:00 beck 2017-01-23T22:34:38+00:00 urn:sha1:55d9c35ce5b03ba866ed2d1ee18cc453731cf722 the ssl_ctx from internal - these are used directly by python and openvpn and a few other things - we have the set accessors but the get accessors were added in 1.1 and these roll their own caveat OPENSSL_VERSION chickenpluckery Move most of the fields in SSL_CTX to internal - the ones that remain are 2017-01-23T05:13:02+00:00 jsing 2017-01-23T05:13:02+00:00 urn:sha1:4630d5542486d6e54b467c2ff4c949c001f4c5f6 known to be in use. ok beck@ Move callback function pointers and argument pointers from SSL_CTX to 2017-01-23T04:15:28+00:00 jsing 2017-01-23T04:15:28+00:00 urn:sha1:779cc82ab96e48a0162ed5caa96bbc04dd3a5c72 internal. ok beck@