| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Remove ssl3_undef_enc_method - if we have internal bugs we want to segfault | jsing | 2017-01-26 | 5 | -36/+8 |
| | | | | | | | | so that we can debug it, rather than adding a "should not be called" error to the stack. Discussed with beck@ | ||||
| * | Remove a sess_cert reference from a comment in the public header. | jsing | 2017-01-26 | 1 | -5/+2 |
| | | | | | Noted by zhuk@ | ||||
| * | split the tls_init(3) that had grown fat to allow healthy future growth; | schwarze | 2017-01-25 | 15 | -888/+1474 |
| | | | | | suggested by jsing@; "i would just chuck it in" jmc@ | ||||
| * | Fix array initialization syntax for ocspcheck.c | inoguchi | 2017-01-25 | 1 | -1/+1 |
| | | | | | | Conformance to C99, and avoiding build break on VisualStudio and HP-UX. OK millert@ | ||||
| * | document BN_asc2bn(3); | schwarze | 2017-01-25 | 1 | -3/+27 |
| | | | | | jsing@ confirmed that it is a public function worth documenting | ||||
| * | remove __BEGIN_DECLS and __END_DECLS from http.h | inoguchi | 2017-01-25 | 1 | -5/+1 |
| | | | | | | sync with ocspcheck and acme-client ok benno@ | ||||
| * | bring changes from acme-client over here. | benno | 2017-01-25 | 1 | -56/+54 |
| | | | | | ok beck@ | ||||
| * | Update ssl versions regress to handle min/max configured versions and | jsing | 2017-01-25 | 1 | -47/+201 |
| | | | | | the cover the ssl_supported_version_range() function. | ||||
| * | Limit enabled version range by the versions configured on the SSL_CTX/SSL, | jsing | 2017-01-25 | 3 | -23/+84 |
| | | | | | | | | provide an ssl_supported_versions_range() function which also limits the versions to those supported by the current method. ok beck@ | ||||
| * | Add start of a regress for cert gen and validation. not clean, won't | beck | 2017-01-25 | 5 | -0/+394 |
| | | | | | hook it up yet | ||||
| * | link in rsa test | beck | 2017-01-25 | 1 | -1/+2 |
| | | |||||
| * | Add rsa test from openssl, since it has a license now | beck | 2017-01-25 | 2 | -0/+344 |
| | | |||||
| * | Change the SSL_IS_DTLS() macro to check the version, rather than using a | jsing | 2017-01-25 | 2 | -7/+4 |
| | | | | | | | | flag in the encryption methods. We can do this since there is currently only one DTLS version. This makes upcoming changes easier. ok beck@ | ||||
| * | Construct a BN_gcd_nonct, based on BN_mod_inverse_no_branch, as suggested | beck | 2017-01-25 | 6 | -10/+170 |
| | | | | | | | | | | | | by Alejandro Cabrera <aldaya@gmail.com> to avoid the possibility of a sidechannel timing attack during RSA private key generation. Modify BN_gcd to become not visible under LIBRESSL_INTERNAL and force the use of the _ct or _nonct versions of the function only within the library. ok jsing@ | ||||
| * | Provide ssl3_packet_read() and ssl3_packet_extend() functions that improve | jsing | 2017-01-25 | 3 | -35/+59 |
| | | | | | | | | the awkward API provided by ssl3_read_n(). Call these when we need to read or extend a packet. ok beck@ | ||||
| * | Provide defines for SSL_CTRL_SET_CURVES/SSL_CTRL_SET_CURVES_LIST for things | jsing | 2017-01-25 | 1 | -1/+15 |
| | | | | | | | | | that are conditioning on these. From BoringSSL. ok beck@ | ||||
| * | fix make clean and warnings | otto | 2017-01-24 | 2 | -1/+3 |
| | | |||||
| * | make sure realloc preserves data | otto | 2017-01-24 | 1 | -17/+45 |
| | | |||||
| * | use ${.OBJDIR} | otto | 2017-01-24 | 1 | -8/+8 |
| | | |||||
| * | BUF_MEM_free(), X509_STORE_free() and X509_VERIFY_PARAM_free() all check | jsing | 2017-01-24 | 2 | -18/+10 |
| | | | | | for NULL, as does lh_free() - do not do the same from the caller. | ||||
| * | sk_free() checks for NULL so do not bother doing it from the callers. | jsing | 2017-01-24 | 4 | -10/+9 |
| | | |||||
| * | sk_pop_free() checks for NULL so do not bother doing it from the callers. | jsing | 2017-01-24 | 7 | -50/+31 |
| | | |||||
| * | Within libssl a SSL_CTX * is referred to as a ctx - fix this for | jsing | 2017-01-24 | 1 | -29/+29 |
| | | | | | SSL_CTX_free(). | ||||
| * | correct usage format; ok beck claudio benno | deraadt | 2017-01-24 | 1 | -2/+3 |
| | | |||||
| * | in resolver(3), document that _EDNS0 and _DNSSEC are no ops; | jmc | 2017-01-24 | 1 | -6/+17 |
| | | | | | | | | diff from kirill miazine while here, bump all the no op texts to one standard blurb; help/ok jca | ||||
| * | fix mode on open() and ftruncate(), noticed by | beck | 2017-01-24 | 1 | -2/+4 |
| | | | | | bcook@ | ||||
| * | #if 0 the ecformats_list and eccurves_list - these are currently unused but | jsing | 2017-01-24 | 1 | -2/+5 |
| | | | | | will be revisited at some point in the near future. | ||||
| * | Remove unused cert variable. | jsing | 2017-01-24 | 1 | -3/+1 |
| | | | | | Found by bcook@ | ||||
| * | Say no to two line error messages on failure | beck | 2017-01-24 | 1 | -4/+3 |
| | | |||||
| * | s/returns/exits/ | beck | 2017-01-24 | 1 | -2/+2 |
| | | |||||
| * | Break run-on sentence into two. | beck | 2017-01-24 | 1 | -3/+4 |
| | | |||||
| * | string terminator is called a NUL | deraadt | 2017-01-24 | 2 | -5/+5 |
| | | |||||
| * | Actually load the cafile when providede, and error message cleanup | beck | 2017-01-24 | 1 | -4/+4 |
| | | |||||
| * | use warn, I have errno here. noticed by theo | beck | 2017-01-24 | 1 | -1/+1 |
| | | |||||
| * | Yes the "if (const == val" idiom provides some safety, but it grates on | deraadt | 2017-01-24 | 1 | -58/+58 |
| | | | | | | us too much. ok beck jsing | ||||
| * | knf | beck | 2017-01-24 | 1 | -1/+2 |
| | | |||||
| * | revert accidental commit of theo diff | beck | 2017-01-24 | 1 | -58/+58 |
| | | |||||
| * | Just don't bother with OpenSSL error strings, they are mostly | beck | 2017-01-24 | 2 | -77/+71 |
| | | | | | irrelevant and look gross here anyway.. we don't need them | ||||
| * | various cleanup; | jmc | 2017-01-24 | 2 | -29/+28 |
| | | |||||
| * | Bump libssl and libtls minors due to symbol additions. | jsing | 2017-01-24 | 2 | -2/+2 |
| | | |||||
| * | slight cleanups | deraadt | 2017-01-24 | 1 | -4/+3 |
| | | |||||
| * | Add a -groups option to openssl s_client, which allows supported EC curves | jsing | 2017-01-24 | 1 | -7/+17 |
| | | | | | | | to be specified as a colon separated list. ok beck@ | ||||
| * | Update client tests for changes in default EC formats/curves. | jsing | 2017-01-24 | 1 | -52/+31 |
| | | |||||
| * | Add support for setting the supported EC curves via | jsing | 2017-01-24 | 7 | -26/+197 |
| | | | | | | | | | | | | | | SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous SSL{_CTX}_set1_curves{_list} names. This also changes the default list of EC curves to be X25519, P-256 and P-384. If you want others (such a brainpool) you need to configure this yourself. Inspired by parts of BoringSSL and OpenSSL. ok beck@ | ||||
| * | s/exit/exist/ typo | beck | 2017-01-24 | 1 | -2/+2 |
| | | |||||
| * | New ocspcheck utility to validate a certificate against its ocsp responder | beck | 2017-01-24 | 5 | -0/+1634 |
| | | | | | | | and save the reply for stapling ok deraadt@ jsing@ | ||||
| * | Correct bounds checks used when generating the EC curves extension. | jsing | 2017-01-24 | 1 | -3/+3 |
| | | | | | ok beck@ | ||||
| * | accross -> across; | jmc | 2017-01-24 | 1 | -2/+2 |
| | | |||||
| * | Use prime256v1 for tests unless otherwise specified. | jsing | 2017-01-24 | 1 | -4/+0 |
| | | |||||
| * | Fix typo in brainpool curve name within a comment. | jsing | 2017-01-24 | 1 | -2/+2 |
| | | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |