openbsd/src/lib/libssl/ssl_rsa.c, branch OPENBSD_7_9_BASE

revert accidental disabling of ssl_security_cert() in -r1.52

2025-08-14T15:55:54+00:00

Add a reasonable ML-KEM API for public use.

2025-08-14T15:48:48+00:00

Adapt the tests to use this API. This does not yet make the symbols public in Symbols.list which will happen shortly with a bump. This includes some partial rototilling of the non-public interfaces which will be shortly continued when the internal code is deduplicated to not have multiple copies for ML-KEM 768 and ML-KEM 1024 (which is just an artifact of unravelling the boring C++ code). ok jsing@, tb@

Fix two more unchecked EVP_PKEY_assign() calls

2023-12-30T06:25:56+00:00

In SSL{_CTX}_use_RSAPrivateKey() switch from EVP_PKEY_assign_RSA() to EVP_PKEY_set1_RSA() and hold on to the reference of the the pkey for the duration of ssl_set_pkey(). Use single exit and other minor style cleanups. ok joshua jsing

Hide all public symbols in libssl

2023-07-08T16:40:14+00:00

With the guentherizer 9000 ok tb@

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Recommit -r1.45 but without error checking EVP_PKEY_copy_parameters()

2022-08-31T20:49:37+00:00

EVP_PKEY_copy_parameters() will unconditionally fail if the pkey's ameth has no copy_params(). Obviously this is indistinguishable from actual failure... ok jsing

Revert r1.46. Causes fireworks in regress.

2022-08-31T20:20:53+00:00

Avoid potential NULL dereference in ssl_set_pkey()

2022-08-31T06:51:36+00:00

Switch from X509_get_pubkey() to X509_get0_pubkey() to avoid an unnecessary EVP_PKEY_free(). Check the return values of X509_get0_pubkey() and EVP_PKEY_copy_parameters(). If the former returns NULL, the latter will dereference NULL. CID 25020 ok jsing

Rename use_* to ssl_use_* for consistency.

2022-06-30T09:08:35+00:00

discussed with jsing

Make ssl_cert_add{0,1}_chain_cert() take ssl/ctx

2022-06-29T21:18:04+00:00

ok beck jsing