openbsd/src/lib/libtls/tls_config.c, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92026-04-16T07:33:11+00:00libtls: use TLS_ERROR_OUT_OF_MEMORY after malloc failure2026-04-16T07:33:11+00:00tb2026-04-16T07:33:11+00:00urn:sha1:8dfa678933bc42faeff1d9406e589c16fac7f60e
tls_config_load_file() hat a spot that used TLS_ERROR_UNKNOWN, so switch
that to the usual error code. Use tls_error_setx() since strerror(ENOMEM)
adds nothing.
From Michael Forney
ok bcook
use O_CLOEXEC; ok tb2026-03-10T05:26:04+00:00deraadt2026-03-10T05:26:04+00:00urn:sha1:71927d7dd981f6e0a9705dd2ddf5bc60abfbaeablibtls: fix legacy protocol parsing2024-08-02T15:00:01+00:00tb2024-08-02T15:00:01+00:00urn:sha1:b406bf2119594dc725dd7e537eb049151f94db87
Redefining TLS_PROTOCOL_TLSv1_0 and TLS_PROTOCOL_TLSv1_1 to be the same
as TLS_PROTOCOL_TLSv1_2 had undesired side effects, as witnessed in the
accompanying regress tests. The protocol string all:tlsv1.0 would disable
TLSv1.2 (so only enable TLSv1.3) and tlsv1.2:!tlsv1.1 would disable all
protocols.
It makes more sense to ignore any setting of TLSv1.0 and TLSv1.1, so if
you request 'tlsv1.1' you get no protocol, but 'all:!tlsv1.1' will enable
the two supported protocols TLSv1.3 and TLSv1.2.
Restore the defines to their original values and adjust the parsing code
to set/unset them.
Issue reported by Kenjiro Nakayama
Fixes https://github.com/libressl/openbsd/issues/151
with/ok jsing
Use TLS_ERROR_INVALID_ARGUMENT for "too large" and "too small" errors2024-03-28T06:55:02+00:00joshua2024-03-28T06:55:02+00:00urn:sha1:d3012ebd0480445b9625c35635eb2e6849c6501a
ok beck tb
Add TLS_ERROR_INVALID_ARGUMENT error code to libtls2024-03-27T07:35:30+00:00joshua2024-03-27T07:35:30+00:00urn:sha1:2f91b3106eca7de0d2c1cd49842ac4b5e027fc63
This is an initial pass, defining the error code and using it for
"too long"/length-related errors.
ok beck jsing
Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
Remove the ability to do tls 1.0 and 1.1 from libtls.2023-07-02T06:37:27+00:00beck2023-07-02T06:37:27+00:00urn:sha1:908a2337ae4c28163a92b9fda969dbdd36bc634b
With this change any requests from configurations to request
versions of tls before tls 1.2 will use tls 1.2. This prepares
us to deprecate tls 1.0 and tls 1.1 support from libssl.
ok tb@
add missing #include <string.h>; ok tb@2023-05-14T07:26:25+00:00op2023-05-14T07:26:25+00:00urn:sha1:751c792967481bc8add0d09d060248a9d59cfadfIntroduce a signer interface intented to make TLS privsep simpler2022-01-25T21:51:24+00:00eric2022-01-25T21:51:24+00:00urn:sha1:bff2f4430c3c0f9cc4584883118372ffbdcbd1e6
to implement.
Add a tls_config_set_sign_cb() function that allows to register
a callback for the signing operation on a tls_config. When used,
the context installs fake pivate keys internally, and the callback
receives the hash of the public key.
Add a tls_signer_*() set of functions to manage tls_signer objects.
A tls_signer is an opaque structure on which keys are added.
It is used to compute signatures with private keys identified by
their associated public key hash.
Discussed with and ok jsing@ tb@
Print uid with %u instead of %i.2021-10-21T08:33:07+00:00tb2021-10-21T08:33:07+00:00urn:sha1:f84744447839633dcb3a43f99540a7ca822878dd
Prompted by a diff by Jonas Termansen, discussed with deraadt, millert
ok jsing