openbsd/src/lib/libssl/ssl_seclevel.c, branch OPENBSD_7_9

ssl_seclevel: remove comment pertaining to DSA certs

2025-01-18T10:52:09+00:00

ok jsing

libssl: rework cert signature security level

2024-10-17T06:19:06+00:00

This switches to using the X509_get_signature_info() API instead of hand rolling a part of it. This is slightly tangly since the security level API is strange. In particular, some failures are passed to the security level callback so that applications can override them. This makes the security level API handle RSA-PSS and EdDSA certificates correctly and the handshake with such can progress a bit further. Of note, we check that the certs are actually suitable for use in TLS per RFC 8446 contrary to what OpenSSL does. ok beck jsing

Plug a "leak" in ssl_security_group()

2024-05-09T07:12:03+00:00

The way the CBB API is used, CBB_add_u16() and CBB_finish() can't actually fail here, but if they could, cbb->base would leak. Rewrite this code with the proper idioms to make it look right. ok jsing

Make internal header file names consistent

2022-11-26T16:08:57+00:00

Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include was fixed manually. discussed with jsing, no objection bcook

Get rid of SSL_CTX_INTERNAL and SSL_INTERNAL.

2022-10-02T16:36:42+00:00

These are no longer necessary due to SSL_CTX and SSL now being fully opaque. Merge SSL_CTX_INTERNAL back into SSL_CTX and SSL_INTERNAL back into SSL. Prompted by tb@

Provide ssl_security_shared_group()

2022-08-17T18:41:17+00:00

Refactor ssl_security_supported_group() into a wrapper of a new internal ssl_security_group() which takes a secop as an argument. This allows adding ssl_security_shared_group() which will be needed in upcoming commits. ok jsing

update copyright years

2022-07-30T17:26:01+00:00

Disallow MD5 and SHA-1 HMACs depending on the security level

2022-07-19T18:55:12+00:00

Ciphers using an MD5 HMAC are not allowed on security levels >= 1 and using a SHA-1 HMAC is disallowed on security levels >= 4. This disables RC4-MD5 by default. ok jsing

Use a local bits variable to avoid ugly line break due to nested function

2022-07-07T17:08:28+00:00

calls. ok jsing

Unifdef LIBRESSL_HAS_SECURITY_LEVEL and remove some workarounds

2022-07-07T13:04:39+00:00

that are no longer needed now that libcrypto exposes the necessary security-bits API. ok jsing