A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9 2025-10-24T11:36:08+00:00 2025-10-24T11:36:08+00:00 tb 2025-10-24T11:36:08+00:00 urn:sha1:da2e8f3e57cf705fb1f88e94e321027a68cb42cf As reported by ajacoutot and sthen, an update to net/neon is blocked on that missing symbol. ok kenjiro 2025-10-24T09:23:06+00:00 tb 2025-10-24T09:23:06+00:00 urn:sha1:2e803cbe8e599c0ae52e9dda44c3d22e3dec105d This allows a const correct SSL_SESSION_dup() implementation at the cost of casting away const due to the const incorrect CRYPTO_dup_ex_data()... (I should look into fixing that, but things like rust-openssl make that hard at this point in the release cycle.) ok kenjiro (as part of a larger diff) 2025-03-09T15:53:36+00:00 tb 2025-03-09T15:53:36+00:00 urn:sha1:868965d7ddee60d0be2a9a0555eaa25936c7b901 Various ports throw a warning since their tls_session_secret_cb's signature doesn't match what we expect. Aligns us with OpenSSL 1.1. This is only useful for RFC 4851 EAP-FAST implementations and surprisingly it's undocumented. ok jsing 2024-07-22T14:47:15+00:00 jsing 2024-07-22T14:47:15+00:00 urn:sha1:bad64c687dbea7670efcb08ff393fe641d0e673d OpenSSL has had the concept of cipher IDs, which were a way of working around overlapping cipher suite values between SSLv2 and SSLv3. Given that we no longer have to deal with this issue, replace the use of IDs with cipher suite values. In particular, this means that we can stop mapping back and forth between the two, simplifying things considerably. While here, remove the 'valid' member of the SSL_CIPHER. The ssl3_ciphers[] table is no longer mutable, meaning that ciphers cannot be disabled at runtime (and we have `#if 0' if we want to do it at compile time). Clean up the comments and add/update RFC references for cipher suites. ok tb@ 2024-07-20T04:04:23+00:00 jsing 2024-07-20T04:04:23+00:00 urn:sha1:026ea65c83ed46dcfd89ada1f6250daa4fcc01b3 For a long time SSL_SESSION has had both a cipher ID and a pointer to an SSL_CIPHER (and not both are guaranteed to be populated). There is also a pointer to an SSL_CIPHER in the SSL_HANDSHAKE that denotes the cipher being used for this connection. Some code has been using the cipher from SSL_SESSION and some code has been using the cipher from SSL_HANDSHAKE. Remove cipher from SSL_SESSION and use the version in SSL_HANDSHAKE everywhere. If resuming from a session then we need to use the SSL_SESSION cipher ID to set the SSL_HANDSHAKE cipher. And we still need to ensure that we update the cipher ID in the SSL_SESSION whenever the SSL_HANDSHAKE cipher changes (this only occurs in a few places). ok tb@ 2024-07-19T08:54:31+00:00 jsing 2024-07-19T08:54:31+00:00 urn:sha1:f5a7be1aa230b5dad73001a01843e188c2475c6a SSL_SESSION has a 'ciphers' member which contains a list of ciphers that were advertised by the client. Move this from SSL_SESSION to SSL_HANDSHAKE and rename it to match reality. ok tb@ 2024-03-27T06:47:52+00:00 tb 2024-03-27T06:47:52+00:00 urn:sha1:800dd0c435a3a2eadbab83dec5ba0a11d3716708 ok jsing 2024-01-24T14:05:10+00:00 jsing 2024-01-24T14:05:10+00:00 urn:sha1:507757029f70803dface2476d554510285e7d100 It is now safe to call delete from an lhash doall callback - stop fiddling wit hash table internals from lhash doall callers that previously has to workaround this themselves. ok tb@ 2023-11-19T15:51:49+00:00 tb 2023-11-19T15:51:49+00:00 urn:sha1:aeabb2194b33a83bfaeb9720b483321f7244a982 As usual, a few manual fixes to avoid duplicate lines. ok jsing 2023-07-08T16:40:14+00:00 beck 2023-07-08T16:40:14+00:00 urn:sha1:fce75ad52c1586db1ba9f44c6be85668e7d4a110 With the guentherizer 9000 ok tb@