openbsd/src, branch libressl-v3.4.0A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=libressl-v3.4.02021-09-14T23:07:18+00:00Avoid typedef redefinition2021-09-14T23:07:18+00:00inoguchi2021-09-14T23:07:18+00:00urn:sha1:76f3844ea887613e8a6df2ccc1f84d9ac93169b3
"typedef struct ssl_st SSL;" is defined in ossl_typ.h.
This reverts part of r1.204.
ok tb@
Add missing void to definition of http_init().2021-09-14T16:37:20+00:00tb2021-09-14T16:37:20+00:00urn:sha1:754c6031403524bc1e6720ad57276c759275f554
ok deraadt florian
zap trailing white space2021-09-14T14:35:09+00:00tb2021-09-14T14:35:09+00:00urn:sha1:746c55aa543d6248b92ed473eba70fcb07059390Call the info cb on connect/accept exit in TLSv1.32021-09-14T14:31:21+00:00tb2021-09-14T14:31:21+00:00urn:sha1:2b3f71d6bd6fb2c09b1e9b6022796a88a8ac4f7f
The p5-Net-SSLeay test expects the info callback to be called on
connect exit. This is the behavior in the legacy stack but wasn't
implemented in the TLSv1.3 stack. With this commit, p5-Net-SSLeay
tests are happy again after the bump.
ok bluhm inoguchi jsing
provide a small manual page for the SSL_set_psk_use_session_callback(3)2021-09-14T14:30:57+00:00schwarze2021-09-14T14:30:57+00:00urn:sha1:893064c29739c4260c6617f7fdd94a8a802ae9cb
stub, written from scratch;
OK tb@ on SSL_set_psk_use_session_callback.3
Merge the stub SSL_SESSION_is_resumable(3) manual page from the2021-09-14T14:08:15+00:00schwarze2021-09-14T14:08:15+00:00urn:sha1:1b8306e7e3cdef25c29c63bc651d4ae5597212f8
OpenSSL 1.1.1 branch, which is still under a free license.
A few tweaks to wording and structure by me.
OK tb@ on SSL_SESSION_is_resumable.3
As suggested by tb@, merge the description of OPENSSL_EC_NAMED_CURVE2021-09-14T13:47:59+00:00schwarze2021-09-14T13:47:59+00:00urn:sha1:8516f8e8e45c406ec2ca34ec57684ee01de472a5
and OPENSSL_EC_EXPLICIT_CURVE
from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000
after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE
in ec/ec_lib.c rev. 1.41,
which is the same default that OpenSSL uses since 1.1.0.
While merging, drop the description of the pre-1.1.0 behaviour.
It seems irrelevant to me because tb@ found no application in Debian
codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default
that was probably never relied upon by anyone does not need to be
documented.
In X509_check_issued() do the same dance around x509v3_cache_extensions()2021-09-13T15:26:53+00:00claudio2021-09-13T15:26:53+00:00urn:sha1:a8af1574ae71c3f2012323155f8e2c784780de4c
as in all other palces. Check the EXFLAG_SET flag first and if not set
grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions().
OK tb@ beck@
Default to using named curve parameter encoding2021-09-12T16:23:19+00:00tb2021-09-12T16:23:19+00:00urn:sha1:10e8e3b7f398be5d656d5725a95663a364220e35
The pre-OpenSSL 1.1.0 default was to use explicit curve parameter
encoding. Most applications want to use named curve parameter encoding
and have to opt into this explicitly.
Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years
ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into
the old default. According to Debian's codesearch, no application
currently does this, which indicates that we currently have a bad default.
In the future it is more likely that applications expect the new
default, so we follow OpenSSL to avoid problems.
Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing.
ok beck inoguchi jsing
merge the description of SSL_get_tlsext_status_type(3)2021-09-11T18:58:41+00:00schwarze2021-09-11T18:58:41+00:00urn:sha1:13dbc996ebccef083673eb0d489a35eda7075e9a
from the OpenSSL 1.1.1 branch, which is still under a free license