summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Update Symbols.list after API additionstb2021-09-101-0/+18
|
* Bump minor after symbol additiontb2021-09-101-1/+1
|
* Add BN_bn2{,le}binpad(), BN_lebin2bn(), EC_GROUP_order_bits to Symbols.listtb2021-09-101-0/+4
| | | | ok beck inoguchi jsing
* Move SSL_set0_rbio() outside of LIBRESSL_HAS_TLS1_3tb2021-09-101-3/+1
| | | | ok inoguchi jsing
* Expose SSL_get_tlext_status_type() in tls1.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_R_NO_APPLICATION_PROTOCOL in ssl.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE in ssl.htb2021-09-101-3/+1
| | | | ok beck jsing
* Expose SSL_CTX_get0_privatekey() in ssl.htb2021-09-101-3/+1
| | | | ok beck
* Remove TLS1_get_{,client_}version()tb2021-09-101-9/+1
| | | | ok jsing
* Remove SSL3_RECORD and SSL3_BUFFERtb2021-09-101-25/+1
| | | | with/ok jsing
* Remove TLS1_RT_HEARTBEATtb2021-09-101-2/+1
| | | | ok jsing
* Make SSL opaquetb2021-09-101-2/+4
| | | | with/ok jsing
* Remove struct tls_session_ticket_ext_st and TLS_SESSION_TICKET_EXTtb2021-09-102-2/+6
| | | | | | from public visibility. with/ok jsing
* Uncomment LIBRESSL_HAS_{TLS1_3,DTLS1_2} in opensslfeatures.htb2021-09-101-2/+2
|
* Use BN_RAND_* instead of mysterious values in the documentation oftb2021-09-101-7/+19
| | | | | | | | BN_rand_range() From OpenSSL 1.1.1l ok beck jsing
* Expose EC_GROUP_order_bits() in <openssl/ec.h>tb2021-09-101-3/+1
| | | | ok beck jsing
* Expose BN_bn2{,le}binpad() and BN_lebin2bn() in <openssl/bn.h>tb2021-09-101-3/+1
| | | | ok beck inoguchi
* Expose BN_RAND_* in <openssl/bn.h>tb2021-09-101-3/+1
| | | | ok beck jsing
* Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callbacktb2021-09-104-7/+31
| | | | | | | | | | | | | | | | | | | As reported by Jeremy Harris, we inherited a strange behavior from OpenSSL, in that we ignore the SSL_TLSEXT_ERR_FATAL return from the ALPN callback. RFC 7301, 3.2 states: 'In the event that the server supports no protocols that the client advertises, then the server SHALL respond with a fatal "no_application_protocol" alert.' Honor this requirement and succeed only on SSL_TLSEXT_ERR_{OK,NOACK} which is the current behavior of OpenSSL. The documentation change is taken from OpenSSL 1.1.1 as well. As pointed out by jsing, there is more to be fixed here: - ensure that the same protocol is selected on session resumption - should the callback be called even if no ALPN extension was sent? - ensure for TLSv1.2 and earlier that the SNI has already been processed ok beck jsing
* Prepare to provide BN_RAND_* flags for BN_rand_range()tb2021-09-101-1/+12
| | | | ok beck jsing
* Prepare to provide SSL_CTX_get0_privatekey()tb2021-09-102-2/+14
| | | | ok beck
* Ensure that the kill signal undergoing testing is not ignored.anton2021-09-091-1/+15
| | | | ok bluhm@
* When calling the legacy callback, ensure we catch the case where itbeck2021-09-091-2/+5
| | | | | | | | | has decided to change a succeess to a failure and change the error code. Fixes a regression in the openssl-ruby tests which expect to test this functionality. ok tb@
* Rework openssl-ruby-tests to run all passing tests first, thentb2021-09-091-4/+12
| | | | | | | | | | | run the one failing test as a separate regress test. This way, all regressions should be caught with REGRESS_FAIL_EARLY=yes or on bluhm's regress webpage. This needs an up-to-date openssl-ruby-tests package and an upcoming commit by beck in x509_verify.c to work. ok beck bluhm
* zap trailing whitespacetb2021-09-092-14/+14
|
* Prepare to provide EC_GROUP_order_bits()tb2021-09-0811-18/+45
| | | | ok jsing
* Provide SSL_SESSION_is_resumable and SSL_set_psk_use_session_callback stubstb2021-09-083-3/+24
| | | | ok jsing
* Prepare to provide API stubs for PHAtb2021-09-082-2/+27
| | | | ok bcook jsing
* Fix leak in cms_RecipientInfo_kekri_decrypt()tb2021-09-081-1/+2
| | | | | | | | Free ec->key before reassigning it. From OpenSSL 1.1.1, 58e1e397 ok inoguchi
* Prepare to provide SSL_get_tlsext_status_type()tb2021-09-083-3/+20
| | | | | | Needed for nginx-lua to build with opaque SSL. ok inoguchi jsing
* Prepare to provide SSL_set0_rbio()tb2021-09-082-2/+12
| | | | | | | This is needed for telephony/coturn and telephony/resiprocate to compile without opaque SSL. ok inoguchi jsing
* Prepare to provide BN_bn2{,le}binpad() and BN_lebin2bn()tb2021-09-082-9/+137
| | | | | | | | | As found by jsg and patrick, this is needed for newer uboot and will also be used in upcoming elliptic curve work. This is from OpenSSL 1.1.1l with minor style tweaks. ok beck inoguchi
* Replace bare ; with continue;job2021-09-081-7/+7
| | | | OK tb@
* Fix indentation of comments and labelsjob2021-09-082-165/+167
| | | | OK tb@
* Replace (&(x)) pattern with &xjob2021-09-072-32/+32
| | | | | | No functional changes. OK tb@
* KNFjob2021-09-072-1478/+1548
| | | | OK tb@ jsing@ beck@
* The default Ruby has switched to 3.0tb2021-09-061-2/+2
|
* new sentence, new line, and tweak wording of previous;jmc2021-09-051-2/+3
|
* Remove unused variable tmptm in do_body of openssl(1) cainoguchi2021-09-051-8/+2
|
* Using serial number instead as subject if it is empty in openssl(1) cainoguchi2021-09-052-3/+36
| | | | | | | This allows multiple entries without a subject even if unique_subject == yes. Referred to OpenSSL commit 5af88441 and arranged for our codebase. ok tb@
* Check extensions before setting version to v3inoguchi2021-09-051-5/+10
| | | | | | Referred to OpenSSL commit 4881d849 and arranged for our codebase. comment and ok from tb@
* Use accessor method rather than direct X509 structure accessinoguchi2021-09-051-20/+10
| | | | | | Referred to OpenSSL commit a8d8e06b and arranged for our codebase. comment and ok from tb@
* Factor out the TLSv1.3 code that handles content from TLS records.jsing2021-09-046-80/+238
| | | | | | | | | | | | Currently, the plaintext content from opened TLS records is handled via the rbuf code in the TLSv1.3 record layer. Factor this out and provide a separate struct tls_content, which knows how to track and manipulate the content. This makes the TLSv1.3 code cleaner, however it will also soon also be used to untangle parts of the legacy record layer. ok beck@ tb@
* Refactor ssl_update_cache. This now matches the logic used for TLS 1.3beck2021-09-041-22/+106
| | | | | | | in Openssl 1.1.1 for when to call the session callbacks. I believe it to also generates a lot less eye bleed, confirmed by tb@ ok jsing@ tb@
* Improve DTLS hello request handling code.jsing2021-09-041-2/+8
| | | | | | | Rather than manually checking multiple bytes, actually parse the DTLS handshake message header, then check the values against what we parsed. ok inoguchi@ tb@
* Change dtls1_get_message_header() to take a CBS.jsing2021-09-043-22/+21
| | | | | | The callers know the actual length and can initialise a CBS correctly. ok inoguchi@ tb@
* Improve DTLS record header parsing.jsing2021-09-041-7/+7
| | | | | | | | Rather than pulling out the epoch and then six bytes of sequence number, pull out SSL3_SEQUENCE_SIZE for the sequence number, then pull the epoch off the start of the sequence number. ok inoguchi@ tb@
* Disable tests that don't work in bluhms regress framework.mbuhl2021-09-041-1/+7
|
* Add X509 Extensions for IP Addresses and AS Identifiersjob2021-09-031-1/+2
| | | | | | (subordinate code paths are include guarded) OK tb@
* * add the missing STANDARDS section as noticed by tb@schwarze2021-09-031-3/+20
| | | | | | * mention that the *optionp input string will be modified * clarify that the array of tokens is expected to be NULL-terminated OK millert@ tb@, and the first half of STANDARDS also OK jmc@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-12 09:40:07 +0000