openbsd/src/lib/libssl, branch OPENBSD_7_6 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_6 2024-09-22T14:59:48+00:00 Reinstate bounds check accidentally disabled when defining OPENSSL_NO_DTLS1 2024-09-22T14:59:48+00:00 tb 2024-09-22T14:59:48+00:00 urn:sha1:e58cba35ab15d6597f0c9cd8d6fba1928ade3acf From Kenjiro Nakayama Closes https://github.com/libressl/portable/issues/1097 Make error 235 resolve to "no application protocol" 2024-09-09T07:40:03+00:00 tb 2024-09-09T07:40:03+00:00 urn:sha1:ff309a8343aabbb4675e666bacf197d8838061b4 We accidentally have two errors 235 since we didn't notice that OpenSSL removed the unused SSL_R_TRIED_TO_USE_UNSUPPORTED_CIPHER and later that becamse SSL_R_NO_APPLICATION_PROTOCOL. Getting an "unsupported cipher" error when fiddling with ALPN is confusing, so fix that. ok jsing Fix alert callback in the QUIC layer 2024-09-09T03:55:55+00:00 tb 2024-09-09T03:55:55+00:00 urn:sha1:47902b1741d383c06ea246859858115749b1c9b6 Only close_notify and user_cancelled are warning alerts. All others should be fatal. In order for the lower layers to behave correctly, the return code for fatal alerts needs to be TLS13_IO_ALERT instead of TLS13_IO_SUCCESS. Failure to signal handshake failure in the public API led to a crash in HAProxy when forcing the tls cipher to TLS_AES_128_CCM_SHA256 as found by haproxyfred while investigating https://github.com/haproxy/haproxy/issues/2569 Kenjiro Nakayama found misbehavior of ngtcp2-based servers, wrote a similar patch and tested this version. Fixes https://github.com/libressl/portable/issues/1093 ok jsing Add and use tls13_record_layer_alert_sent() 2024-09-09T03:32:29+00:00 tb 2024-09-09T03:32:29+00:00 urn:sha1:461979ad807ebd887bb629ba3072f150b5390cd2 This is a small refactoring that wraps a direct call to the record layer's alert_sent() callback into a handler for upcoming reuse in the QUIC code. No functional change. ok jsing Update for OPENSSL_cpu_caps() now being machine independent. 2024-08-31T12:46:55+00:00 jsing 2024-08-31T12:46:55+00:00 urn:sha1:55830d0a034a2c58c258e7b84cf9109a49f3b3e7 ok tb@ major bump for libcrypto libssl and libtls 2024-08-31T10:54:12+00:00 tb 2024-08-31T10:54:12+00:00 urn:sha1:71ba87c7b967350832d234fc05a24f33898e3408 Remove SSL_add_compression_method 2024-08-31T10:51:48+00:00 tb 2024-08-31T10:51:48+00:00 urn:sha1:a0ced14fec228fa0dfd2fa5d87c942b0af9326d8 Bump minor after symbol addition 2024-08-12T21:01:54+00:00 tb 2024-08-12T21:01:54+00:00 urn:sha1:da1b60072e25b68e3b324626c8fc684523ac1638 Add SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() to 2024-08-12T21:01:34+00:00 tb 2024-08-12T21:01:34+00:00 urn:sha1:23a58098276c82c22a1f5c0b50128701a8eb0f84 Symbols.list Expose SSL_CTX_set1_cert_store() and SSL_CIPHER_get_handshake_digest() 2024-08-12T21:01:00+00:00 tb 2024-08-12T21:01:00+00:00 urn:sha1:256a003a11f25911f3043525bd58b6c6a5fff015