openbsd/src/lib/libtls, branch libressl-v2.6.0

Document tls_config_set_crl_file() and tls_config_set_crl_mem().

2017-07-06T17:27:19+00:00

Based on a diff from Jack Burton , thanks!

Bump minor due to symbol addition.

2017-07-06T17:12:44+00:00

Add support for providing CRLs to libtls - once a CRL is provided we

2017-07-06T17:12:22+00:00

enable CRL checking for the full certificate chain. Based on a diff from Jack Burton , thanks! Discussed with beck@

RFC 6066 states that IP literals are not permitted in "HostName" for a

2017-07-05T15:38:35+00:00

TLS Server Name extension, however seemingly several clients (including Python, Ruby and Safari) violate the RFC. Given that this is a fairly widespread issue, if we receive a TLS Server Name extension that contains an IP literal, pretend that we did not receive the extension rather than causing a handshake failure. Issue raised by jsg@ ok jsg@

Use the tls_password_cb() callback with all PEM_read_bio_*() calls, so that

2017-06-22T18:03:57+00:00

we can prevent libcrypto from going behind our back and trying to read passwords from standard input (which we may not be permitted to do). Found by jsg@ with httpd and password protected keys.

Fix incorrect indentation.

2017-06-22T17:58:54+00:00

Plug a memory leak in tls_keypair_cert_hash(), introduced in r1.60.

2017-06-22T17:55:48+00:00

Remove dead code that has remained hiding since ressl.c r1.14!

2017-06-22T17:47:56+00:00

Use the standard `rv' idiom in tls_keypair_load_cert(), rather than

2017-06-22T17:34:25+00:00

duplicating clean up code.

Plug a memory leak. The main_cert needs to be X509_free()ed since

2017-05-16T05:52:52+00:00

SSL_get_peer_certificate() increases the ref count whereas extra_certs do not because SSL_get_peer_cert_chain() won't increase ref counts. OK beck@