| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Add a unit test for tls1_PRF(). | jsing | 2017-03-10 | 2 | -1/+257 | |
| | | ||||||
| * | Make tls1_PRF() non-static so it can be regress tested. | jsing | 2017-03-10 | 1 | -2/+7 | |
| | | ||||||
| * | The netcat server did not print the correct TLS error message if | bluhm | 2017-03-09 | 1 | -2/+2 | |
| | | | | | | | the handshake after accept had failed. Use the context of the accepted TLS connection. OK beck@ | |||||
| * | remove bogus variable expansion | eric | 2017-03-09 | 2 | -4/+4 | |
| | | ||||||
| * | missing include | eric | 2017-03-09 | 1 | -1/+2 | |
| | | ||||||
| * | Correctly handle TLS PRF with MD5+SHA1 - the secret has to be partitioned | jsing | 2017-03-07 | 1 | -5/+26 | |
| | | | | | | | and each hash processed separately. Tested by tb@ | |||||
| * | Add a test that covers a libtls client talking to a Go TLS server with | jsing | 2017-03-07 | 1 | -5/+107 | |
| | | | | | | varying minimum and maximum protocol versions. This gives us protocol version test coverage against an independent TLS stack. | |||||
| * | Allow ciphers to be set on the TLS config. | jsing | 2017-03-07 | 1 | -0/+10 | |
| | | ||||||
| * | Provide support for libtls protocols and allow for protocols to be set on | jsing | 2017-03-07 | 1 | -3/+47 | |
| | | | | | | a TLS config. The ConnVersion function now also returns a protocol version instead of a string. | |||||
| * | Add handling for errors on the TLS config and properly check/handle | jsing | 2017-03-07 | 2 | -6/+23 | |
| | | | | | failures when setting the CA file. | |||||
| * | libtls errors are much more descriptive these days - return them directly | jsing | 2017-03-07 | 1 | -9/+8 | |
| | | | | | and avoid adding redundant/duplicate information. | |||||
| * | We no longer need to keep pointers following tls_config_set_*() calls. | jsing | 2017-03-07 | 1 | -6/+3 | |
| | | ||||||
| * | Some tweaks from jmc@ and describe better what recallocarray does; | otto | 2017-03-07 | 1 | -7/+16 | |
| | | | | | help and ok from tom@ and deraadt@ | |||||
| * | Use an unsigned loop variable to avoid a comparison between signed | bluhm | 2017-03-06 | 1 | -1/+1 | |
| | | | | | | and unsigned. Makes the test compile again. OK inoguchi@ | |||||
| * | Introducing recallocarray(3), a blend of calloc(3) and reallocarray(3) | otto | 2017-03-06 | 3 | -7/+147 | |
| | | | | | | with the added feature that released memory is cleared. Much input from various developers. ok deraadt@ tom@ | |||||
| * | size is unsigned so using ==0 not <=0 when checking for buffer exhaustion | millert | 2017-03-06 | 1 | -4/+4 | |
| | | ||||||
| * | Pull in a change from the bind 8 resolver that fixes a potential | millert | 2017-03-06 | 1 | -10/+16 | |
| | | | | | | crash when given a large hex number as part of the dotted quad. OK deraadt@ jsg@ | |||||
| * | Clean up and simplify the tls1_PRF() implementation now that we have a | jsing | 2017-03-06 | 1 | -48/+19 | |
| | | | | | | | single EVP MD for the PRF hash. ok beck@ inoguchi@ | |||||
| * | Correctly convert an SSLv2 challenge into an SSLv3/TLS client random by | jsing | 2017-03-05 | 1 | -9/+27 | |
| | | | | | | | truncating or left zero padding. ok beck@ inoguchi@ sthen@ | |||||
| * | Provide a rolling handshake hash that commences as soon as the cipher | jsing | 2017-03-05 | 8 | -54/+193 | |
| | | | | | | | | | | | suite has been selected, and convert the final finish MAC to use this handshake hash. This is a first step towards cleaning up the current handshake buffer/digest code. ok beck@ inoguchi@ | |||||
| * | Convert various handshake message generation functions to CBB. | jsing | 2017-03-05 | 4 | -56/+113 | |
| | | | | | ok beck@ inoguchi@ | |||||
| * | Add an initial regress test that covers the server-side of libssl, by | jsing | 2017-03-05 | 3 | -1/+220 | |
| | | | | | providing SSL_accept() with fixed ClientHello messages. | |||||
| * | Drop the second argument of dtls1_set_message_header() and make it a void | jsing | 2017-03-04 | 3 | -13/+10 | |
| | | | | | | function. Nothing makes use of the return value and the second argument was only used to produce the return value... | |||||
| * | Call ssl3_handshake_write() instead of ssl3_do_write() - this was missed | jsing | 2017-03-04 | 1 | -2/+2 | |
| | | | | | | | | | | | | when ssl3_send_client_certificate() was converted to the standard handshake functions in r1.150 of s3_clnt.c. This has no impact on TLS, however it causes the DTLS client to fail if the server sends a certificate request, since the TLS MAC is calculated on a non-populated DTLS header. Issue reported by umokk on github. | |||||
| * | Treat "ERROR in STARTUP" as an actual error, rather than failing without | jsing | 2017-03-04 | 1 | -2/+2 | |
| | | | | | | | | exiting non-zero (which has been masking a DTLS related issue). Also make the message consistent with other errors. Spotted by inogochi@ | |||||
| * | Remove commented out code and fix indentation of surrounding statements. | jsing | 2017-03-04 | 1 | -12/+5 | |
| | | ||||||
| * | Remove handling for SSLv2. | jsing | 2017-03-04 | 1 | -14/+3 | |
| | | ||||||
| * | Ensure MD and key initialized before processing HMAC | inoguchi | 2017-03-03 | 2 | -35/+224 | |
| | | | | | | | | | Ensure both MD and key have been initialized before processing HMAC. Releasing HMAC_CTX in error path of HMAC(). In regress test, added test 4,5,6 and cleaned up the code. ok jsing@ | |||||
| * | fix error in Dt; from robert klein | jmc | 2017-03-02 | 1 | -3/+3 | |
| | | ||||||
| * | Convert ssl3_{get,send}_server_key_exchange() to EVP_md5_sha1(). | jsing | 2017-03-01 | 3 | -44/+29 | |
| | | | | | ok inoguchi@ | |||||
| * | Add EVP test for MD5-SHA1. | jsing | 2017-03-01 | 1 | -0/+3 | |
| | | ||||||
| * | Include EVP_md5_sha1() via OpenSSL_add_all_digests(). | jsing | 2017-03-01 | 1 | -1/+2 | |
| | | ||||||
| * | Bump minors due to symbol addition. | jsing | 2017-02-28 | 3 | -3/+3 | |
| | | ||||||
| * | Document EVP_md5_sha1(). | jsing | 2017-02-28 | 1 | -2/+11 | |
| | | ||||||
| * | Add an EVP interface that provides concatenated MD5+SHA1 hashes, which are | jsing | 2017-02-28 | 4 | -2/+88 | |
| | | | | | | | | | | | used in various parts of TLS 1.0/1.1. This will allow for code simplification in libssl. The same interface exists in OpenSSL 1.1. ok beck@ deraadt@ inoguchi@ millert@ | |||||
| * | Fix typo in issuingDistributionPoint description. | jsing | 2017-02-28 | 1 | -1/+1 | |
| | | ||||||
| * | Stop pretending that MD5 and SHA1 might not exist - rather than locating | jsing | 2017-02-28 | 4 | -20/+8 | |
| | | | | | | | | "ssl3-md5" and "ssl-sha1", call the EVP_md5() and EVP_sha1() functions directly. ok beck@ inoguchi@ | |||||
| * | Add support for RES_USE_DNSSEC | jca | 2017-02-27 | 1 | -5/+2 | |
| | | | | | | | | | | | | | RES_USE_DNSSEC is implemented by setting the DNSSEC DO bit in outgoing queries. The resolver is then supposed to set the AD bit in the reply if it managed to validate the answer through DNSSEC. Useful when the application doesn't implement validation internally. This scheme assumes that the validating resolver is trusted and that the communication channel between the validating resolver and and the client is secure. ok eric@ gilles@ | |||||
| * | pledge stdio before parsing the http response | beck | 2017-02-25 | 1 | -9/+11 | |
| | | | | | ok tb@ | |||||
| * | Add missing includes to avoid implicit function declarations. | jsg | 2017-02-25 | 4 | -3/+7 | |
| | | ||||||
| * | Add the following root CAs, from SECOM Trust Systems / Security Communication | sthen | 2017-02-24 | 1 | -1/+126 | |
| | | | | | | | | | of Japan, they are present in Mozilla's CA store. OK ajacoutot@ /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1 /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 /C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1 | |||||
| * | Check return value of every BN_* functions in bntest | inoguchi | 2017-02-23 | 1 | -393/+426 | |
| | | | | | | | | - add macro CHECK_GOTO - unify function return code to rc - add err: label for error goto ok bcook@ | |||||
| * | Remove STREEBOG 512 as a TLS MAC since there are currently no cipher suites | jsing | 2017-02-21 | 2 | -26/+6 | |
| | | | | | | | that make use of it. ok bcook@ inoguchi@ | |||||
| * | don;t end Nd with a full stop; | jmc | 2017-02-21 | 1 | -3/+3 | |
| | | ||||||
| * | Add missing $OpenBSD$ | beck | 2017-02-20 | 1 | -0/+1 | |
| | | ||||||
| * | Mark ERR_add_error_data and ERR_add_error_vdata as not for internal use, | beck | 2017-02-20 | 5 | -14/+81 | |
| | | | | | | and document ERR_asprintf_error_data as their replacement. ok jsing@, ingo@ | |||||
| * | spelling fix; | jmc | 2017-02-20 | 1 | -2/+2 | |
| | | ||||||
| * | document tls_config_error(3) RETURN VALUES, improve what is said | schwarze | 2017-02-20 | 2 | -6/+59 | |
| | | | | | | about tls_error(3), and warn about some traps; OK jmc@ | |||||
| * | Add EDNS0 support. | jca | 2017-02-18 | 1 | -4/+3 | |
| | | | | | | | | EDNS allows for various DNS extensions, among which UDP DNS packets size bigger than 512 bytes. The default is still to not advertize anything. ok eric@ | |||||
| * | Avoid dereferencing a pointer when reporting an error about the same | jsing | 2017-02-15 | 1 | -2/+2 | |
| | | | | | | | pointer being NULL. Found by jsg@ with cppcheck; also detected by Coverity. | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |