openbsd/src/lib/libtls/tls.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-05-24T15:12:54+00:00 Clear SSL_MODE_AUTO_RETRY in libtls, since we handle WANT_POLLIN correctly. 2020-05-24T15:12:54+00:00 jsing 2020-05-24T15:12:54+00:00 urn:sha1:bd5d30588339e3d3f92ae2b76437f6a96396e3c9 Add support for TLSv1.3 as a protocol to libtls. 2020-01-20T08:39:21+00:00 jsing 2020-01-20T08:39:21+00:00 urn:sha1:4964c87c6ff167d81b09c143dff53c224a573ccb This makes tls_config_parse_protocols() recognise and handle "tlsv1.3". If TLSv1.3 is enabled libtls will also request libssl to enable it. ok beck@ tb@ Add a mutex to guard reference counting for tls_config. 2019-04-01T15:58:02+00:00 jsing 2019-04-01T15:58:02+00:00 urn:sha1:21c42a511c7d5693d9e491b79f765c4e74d2c16e This makes libtls more friendly for multithreaded use - otherwise we can end up with incorrect refcounts and end up freeing when we should not be (or not freeing when we should be). ok beck@ expose the default cert file as a function, not a define. it's really 2018-11-29T14:24:23+00:00 tedu 2018-11-29T14:24:23+00:00 urn:sha1:6dee83d0efd9b6a0e45f73737efb9078aafbdd15 an internal detail of the library, so the string should live inside it, not in the application code. ok jsing Define TLS_CA_CERT_FILE rather than having every application create their 2018-11-06T20:34:54+00:00 jsing 2018-11-06T20:34:54+00:00 urn:sha1:c572182382f504af52f71f2197c113d5be045376 own define for /etc/ssl/cert.pem. ok beck@ bluhm@ tb@ Switch to OPENSSL_init_ssl() and prevent an openssl configuration file from 2018-04-07T16:30:59+00:00 jsing 2018-04-07T16:30:59+00:00 urn:sha1:9e6acdbfc336b22b66a0a01c53019f7f4ac612d9 being loaded behind our back, at a later point. ok beck@ Automatically handle library initialisation for libtls. 2018-03-19T16:34:47+00:00 jsing 2018-03-19T16:34:47+00:00 urn:sha1:5fd38b4657cfd0f2e0b0b92fd650c6710e8fbc8b Now that we have tls_init() under pthread_once(), automatically initialise libtls from the entry point functions (tls_config(), tls_client() and tls_server()) - this makes an explicit tls_init() call no longer a requirement. ok bcook@ beck@ inoguchi@ un-revert tls_init pthread_once change, now that stub is added so that builds work 2018-03-08T16:12:00+00:00 beck 2018-03-08T16:12:00+00:00 urn:sha1:6eca2d8d7b6a897175b9334bc65767f168e61b76 backout. diff was not tested comprehensively, resulting in a broken tree. 2018-03-07T19:07:14+00:00 deraadt 2018-03-07T19:07:14+00:00 urn:sha1:20c6beb0e37f43bcc80f533f3d77e23ffc3db32d Make tls_init() concurrently callable using pthread_once(). 2018-03-07T17:17:47+00:00 beck 2018-03-07T17:17:47+00:00 urn:sha1:4064518fd566b68546ba1e341ba42bf7b431a881 ok jsing@ This brings pthread_once usage into libressl, which will need to get dealt with correctly in portable. This sets us up to autoinit libtls, and we will also be using pthread_once to deal with autoinit stuff in libssl and libcrypto