openbsd/src/lib/libtls/tls_ocsp.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2019-12-03T14:56:42+00:00 Add missing RCS tag. 2019-12-03T14:56:42+00:00 tb 2019-12-03T14:56:42+00:00 urn:sha1:d9f0c06c725468a8221653d48dd6cfea8c75ce4d Do not bother NULLing pointers in memory that is freed immediately after. 2018-02-05T01:47:03+00:00 jsing 2018-02-05T01:47:03+00:00 urn:sha1:b38f09002132dbf35d77ee3e74c0a4f30c0cef7e Be consistent with the goto label names used in libtls code. 2018-02-05T00:52:24+00:00 jsing 2018-02-05T00:52:24+00:00 urn:sha1:bc472499298f03ebe5c71920633cfa2b20046c93 No change to generated assembly. Keep track of which keypair is in use by a TLS context. 2017-09-20T17:05:17+00:00 jsing 2017-09-20T17:05:17+00:00 urn:sha1:cb877fda6d4f301551f4f41cbe708b7a31217fba This fixes a bug where by a TLS server with SNI would always only return the OCSP staple for the default keypair, rather than returning the OCSP staple associated with the keypair that was selected via SNI. Issue reported by William Graeber and confirmed by Andreas Bartelt. Fix tested by William Graeber and Andreas Bartelt - thanks! Slightly restructure tls_ocsp_verify_cb() to make it more like libtls code. 2017-09-20T16:52:37+00:00 jsing 2017-09-20T16:52:37+00:00 urn:sha1:373953b07ced62cde74a839d1249fa9b7d8df5e7 Provide a useful error if there are no OCSP URLs in the peer certificate. 2017-09-20T16:38:23+00:00 jsing 2017-09-20T16:38:23+00:00 urn:sha1:87f911b10521db48d4a40fc8d3426bf0af0b23ce Fix indentation. 2017-09-20T16:36:45+00:00 jsing 2017-09-20T16:36:45+00:00 urn:sha1:5068b8b7a6b9aeb5547f87d2352bfa52e9d6c448 Plug a memory leak. The main_cert needs to be X509_free()ed since 2017-05-16T05:52:52+00:00 claudio 2017-05-16T05:52:52+00:00 urn:sha1:7ad9f2edfd93fb9172eacbbd167845c844f2e661 SSL_get_peer_certificate() increases the ref count whereas extra_certs do not because SSL_get_peer_cert_chain() won't increase ref counts. OK beck@ Move the ocsp staple to being part of the keypair structure internally, 2017-01-29T17:52:11+00:00 beck 2017-01-29T17:52:11+00:00 urn:sha1:a787119135c7f989cdcd1f06c15e48d2c75bc4c4 so that it does not send back bogus staples when SNI is in use. (Further change is required to be able to use staples on all keypairs and not just the main one) ok jsing@ More s/OSCP/OCSP/ typos 2017-01-27T07:03:27+00:00 tom 2017-01-27T07:03:27+00:00 urn:sha1:2b01d8e93fb16d46ee115230ed1a242921e4969f ok jmc@