summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* Add support for sending QUIC transport parametersbeck2022-06-298-8/+466
| | | | | | | | | | This is the start of adding the boringssl API for QUIC support, and the TLS extensions necessary to send and receive QUIC transport data. Inspired by boringssl's https://boringssl-review.googlesource.com/24464 ok jsing@ tb@
* Use relative paths so beck can run regress in his git tree and havetb2022-06-294-8/+12
| | | | the correct ssl_local.h etc be picked up.
* whitespace nittb2022-06-291-2/+2
|
* missing blank linetb2022-06-291-1/+2
|
* Refactor asn1 time parsing to use CBS - enforce valid times in ASN.1 parsing.beck2022-06-293-68/+155
| | | | | | | | While we're here enforce valid days for months and leap years. Inspired by same in boringssl. ok jsing@
* Also check the security level in SSL_get1_supported_cipherstb2022-06-291-2/+5
| | | | ok beck jsing
* Check security level when convertin a cipher list to bytestb2022-06-291-1/+4
| | | | ok beck jsing
* Also check the security level when choosing a shared ciphertb2022-06-291-1/+5
| | | | ok beck jsing
* There's tentacles, tentacles everywheretb2022-06-291-1/+7
| | | | ok beck jsing
* Also check the security level of the 'tmp dh'tb2022-06-293-3/+24
| | | | ok beck jsing
* Check the security of DH key sharestb2022-06-296-6/+42
| | | | ok beck, looks good to jsing
* Rename one s to ssl for consistencytb2022-06-291-2/+2
|
* Check sigalg security level when selecting them.tb2022-06-291-1/+4
| | | | ok beck jsing
* Check the security bits of the sigalgs' pkeytb2022-06-291-1/+7
| | | | ok beck jsing
* Check the security level when building sigalgstb2022-06-294-12/+20
| | | | ok beck jsing
* Annotate sigalgs with their security level.tb2022-06-292-2/+23
| | | | ok beck jsing
* Add prototypes for ssl{_ctx,}_security()tb2022-06-281-1/+5
| | | | ok beck jsing sthen
* Add error code definstb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Add a period to a commenttb2022-06-281-2/+2
| | | | Pointed out by jsing
* Security level >= 3 requires a ciphersuite with PFStb2022-06-281-3/+4
| | | | ok beck jsing sthen
* Add a secop handler for tmp_dhtb2022-06-281-1/+19
| | | | | | | This disallows DHE keys weaker than 1024 bits at level 0 to match OpenSSL behavior. ok beck jsing sthen
* Add security level related error codes.tb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Sort error stringstb2022-06-281-3/+3
| | | | ok beck jsing sthen
* Implement ssl{,_ctx}_security()tb2022-06-281-1/+15
| | | | ok beck jsing sthen
* Copy the security level stuff in ssl_cert_dup()tb2022-06-281-1/+5
| | | | ok beck jsing sthen
* Set up the default callback in SSL_CERTtb2022-06-281-1/+8
| | | | ok beck jsing sthen
* Implement the default security level callbacktb2022-06-283-2/+202
| | | | | | And here is where the fun starts. The tentacles will grow everywhere. ok beck jsing sthen
* Provide OPENSSL_TLS_SECURITY_LEVEL definetb2022-06-281-1/+7
| | | | ok beck jsing sthen
* Implement SSL_{CTX_}_{g,s}et_security_level(3)tb2022-06-281-1/+25
| | | | ok beck jsing sthen
* Add security callback, level and ex_data fields to SSL_CERTtb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Add #defines and prototypes for security level APItb2022-06-281-1/+72
| | | | | | | This marks the start of one of the worst API additions in the history of this library. And as everybody knows the bar is high. Very high. ok beck jsing sthen
* Negate unsigned then cast to signed.jsing2022-06-281-2/+2
| | | | | | | | | Avoid undefined behaviour by negating the unsigned value, before casting to int64_t, rather than casting to int64_t then negating. Fixes oss-fuzz #48499 ok tb@
* Take away bogus error assignment before callback call.beck2022-06-281-2/+1
| | | | | | | | | | | | | Keep the depth which was needed. This went an error too far, and broke openssl-ruby's callback and error code sensitivity in it's tests. With this removed, both my newly committed regress to verify the same error codes and depths in the callback, and openssl-ruby's tests pass again. ok tb@
* Botan 2.19.2 has removed support for the OpenSSL crypto provider.bluhm2022-06-282-24/+1
| | | | | | | It was incompatible with OpenSSL 3.0. Remove the regression test to check that LibreSSL crypto works with Botan tests. This is better than to keep an outdated Botan in ports. discussed with tb@ beck@
* Free ciphers before assigning to themtb2022-06-281-6/+6
| | | | | | | | While this is not a leak currently, it definitely looks like one. Pointed out by jsing on review of a diff that touched the vicinity a while ago. ok jsing
* Only asn1time needs to be static for now.tb2022-06-281-2/+4
|
* Make this regress test link staticly and use internal symbolsbeck2022-06-281-1/+2
| | | | so that it works and compiles during the tb@ pre-bump shuffle(tm).
* Fix the legacy verifier callback behaviour for untrusted certs.beck2022-06-283-19/+347
| | | | | | | | | | | | | | | | | | The verifier callback is used by mutt to do a form of certificate pinning where the callback gets fired and depending on a cert saved to a file will decide to accept an untrusted cert. This corrects two problems that affected this. The callback was not getting the correct depth and chain for the error where mutt would save the certificate in the first place, and then the callback was not getting fired to allow it to override the failing certificate validation. thanks to Avon Robertson <avon.r@xtra.co.nz> for the report and sthen@ for analysis. "The callback is not an API, it's a gordian knot - tb@" ok jsing@
* Correct misleading comment for URI parsingbeck2022-06-271-4/+10
| | | | ok jsing@
* Add function to free all of the issuer cache.beck2022-06-271-13/+39
| | | | ok jsing@
* Allow security_level to mestastasize into the verifiertb2022-06-274-4/+156
| | | | | | | | The tentacles are everywhere. This checks that all certs in a chain have keys and signature algorithms matching the requirements of the security_level configured in the verify parameters. ok beck jsing
* Prepare to provide X509_VERIFY_PARAM_set_auth_level()tb2022-06-273-2/+12
| | | | | | | | For some unknown reason this needed a different name than security_level, both internally and in the public API. Obviously it is exactly the same garbage. ok beck jsing
* Add new time manipulation funcitons that OpenSSL has exposed thatbeck2022-06-274-26/+121
| | | | | | | | the world seems to be using. Symbols.list changes and exposure to wait for minor bump ok jsing@ jca@
* Prepare to provide EVP_PKEY_security_bits()tb2022-06-278-8/+75
| | | | | | | This also provides a pkey_security_bits member to the PKEY ASN.1 methods and a corresponding setter EVP_PKEY_asn1_set_security_bits(). ok beck jsing
* Prepare to provide DH_security_bits()tb2022-06-272-2/+18
| | | | ok beck jsing
* Prepare to provide RSA_security_bits()tb2022-06-272-2/+12
| | | | ok beck jsing
* Prepare to provide DSA_security_bits()tb2022-06-272-2/+14
| | | | ok beck jsing
* Prepare to provide BN_security_bits()tb2022-06-272-2/+37
| | | | ok beck jsing
* Provide and use long_{get,set}()jsing2022-06-261-11/+35
| | | | | | | | | Apparently at some point a LONG_it was misaligned - provide and use long_{get,set}() so that we always memcpy() rather than doing it some times but not others. While here provide long_clear() rather than abusing and reusing long_free(). ok tb@
* Fix URI name constraints, allow for URI's with no host part.beck2022-06-262-3/+38
| | | | | | | | | | | Such uri's must be parsed and allowed, but then should fail if a name constraint is present. Adds regress testing for this same case. fixes https://github.com/libressl-portable/openbsd/issues/131 ok tb@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 08:41:10 +0000