openbsd/src/lib/libssl, branch OPENBSD_6_5_BASE

Recommend SSL_CTX_add1_chain_cert(3) rather than

2019-04-09T22:01:50+00:00

SSL_CTX_add_extra_chain_cert(3). From Dr. Stephen Henson via OpenSSL commit a4339ea3 Jan 3 22:38:03 2014 +0000 which is still under a free license.

Document SSL_CTX_clear_mode(3) and SSL_clear_mode(3).

2019-04-09T21:06:31+00:00

From Kurt Roeckx via OpenSSL commit 57fd5170 May 13 11:24:11 2018 +0200 which is still under a free license. While here, polish awkward wording and reduce duplication.

By design, our state machine is a DAG contrary to the state machine in

2019-04-05T20:23:38+00:00

the spec. To avoid the obvious loop in the RFC's state machine, we added a CLIENT_HELLO_RETRY state which is a second ClientHello with special rules. There is, however, no state to react to this second client hello. This adds a matching SERVER_HELLO_RETRY state to the handshakes table. This means in particular that the WITH_HRR state cannot be set in tls13_server_hello_recv(), so remove this now dead check. ok jsing

Import SSL_CTX_add1_chain_cert(3) from OpenSSL branch 1.1.1, which is still

2019-04-05T18:29:43+00:00

under a free license, omitting functions we don't have and tweaked by me; the functions were provided by jsing@ in ssl.h rev. 1.166. While here, also document SSL_CTX_get_extra_chain_certs(3) because it is closely related to companion functions are already documented and the API is kind of incomplete without it.

Zap two dead #defines that were unused since jsing deleted the

2019-04-05T05:13:12+00:00

record_type member of the tls13_handshake_action struct. ok jsing

Implement legacy fallback for the TLS 1.3 client.

2019-04-04T16:53:57+00:00

If the Server Hello received indicates that the server did not negotiate TLS 1.3, fallback to the original TLS client implementation. ok bcook@, tb@

Clean up the cipher/digest table mess.

2019-04-04T16:44:24+00:00

The original implementation allows for libcrypto to be compiled without a given algorithm and libssl then detects that ciphers or digests are unavailable so that it can disable the associated cipher suites. This is unnecessary since we do not compile out algorithms. ok beck@, tb@ (a while back)

Bump libssl/libtls minors due to symbol addition.

2019-04-04T15:04:03+00:00

Provide SSL chain/cert chain APIs.

2019-04-04T15:03:21+00:00

These allow for chains to be managed on a per-certificate basis rather than as a single "extra certificates" list. Note that "chain" in this context does not actually include the leaf certificate however, unlike SSL_CTX_use_certificate_chain_{file,mem}(). Thanks to sthen@ for running this through a bulk ports build. ok beck@ tb@

This case also needs to be fatal.

2019-04-04T14:32:49+00:00