openbsd/src/lib/libtls/tls_server.c, branch OPENBSD_6_8_BASE

Acquire mutex before incrementing the refcount. Fixes COV-186144

2019-05-13T22:36:01+00:00

ok tb@

Automatically handle library initialisation for libtls.

2018-03-19T16:34:47+00:00

Now that we have tls_init() under pthread_once(), automatically initialise libtls from the entry point functions (tls_config(), tls_client() and tls_server()) - this makes an explicit tls_init() call no longer a requirement. ok bcook@ beck@ inoguchi@

Split keypair handling out into its own file - it had already appeared

2018-02-08T05:56:49+00:00

in multiple locations. ok beck@

Keep track of which keypair is in use by a TLS context.

2017-09-20T17:05:17+00:00

This fixes a bug where by a TLS server with SNI would always only return the OCSP staple for the default keypair, rather than returning the OCSP staple associated with the keypair that was selected via SNI. Issue reported by William Graeber and confirmed by Andreas Bartelt. Fix tested by William Graeber and Andreas Bartelt - thanks!

Add a tls_config_set_ecdhecurves() function to libtls, which allows the

2017-08-10T18:18:30+00:00

names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@

RFC 6066 states that IP literals are not permitted in "HostName" for a

2017-07-05T15:38:35+00:00

TLS Server Name extension, however seemingly several clients (including Python, Ruby and Safari) violate the RFC. Given that this is a fairly widespread issue, if we receive a TLS Server Name extension that contains an IP literal, pretend that we did not receive the extension rather than causing a handshake failure. Issue raised by jsg@ ok jsg@

Use the tls_password_cb() callback with all PEM_read_bio_*() calls, so that

2017-06-22T18:03:57+00:00

we can prevent libcrypto from going behind our back and trying to read passwords from standard input (which we may not be permitted to do). Found by jsg@ with httpd and password protected keys.

Use the standard `rv' idiom in tls_keypair_load_cert(), rather than

2017-06-22T17:34:25+00:00

duplicating clean up code.

Perform reference counting for tls_config. This allows tls_config_free() to

2017-05-06T20:59:28+00:00

be called as soon as it has been passed to the final tls_configure() call, simplifying lifetime tracking for the application. Requested some time ago by tedu@. ok beck@

Rework name verification code so that a match is indicated via an argument,

2017-04-10T17:11:13+00:00

rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg . ok beck@ jca@