summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Make example slightly less terrible by dropping the ENGINE "handling"tb2024-07-211-5/+4
|
* Fix golden numbers after beck broke it months agotb2024-07-202-23/+20
| | | | (why is it always me who gets to clean up this shit?)
* Remove cipher from SSL_SESSION.jsing2024-07-2013-73/+70
| | | | | | | | | | | | | | | | For a long time SSL_SESSION has had both a cipher ID and a pointer to an SSL_CIPHER (and not both are guaranteed to be populated). There is also a pointer to an SSL_CIPHER in the SSL_HANDSHAKE that denotes the cipher being used for this connection. Some code has been using the cipher from SSL_SESSION and some code has been using the cipher from SSL_HANDSHAKE. Remove cipher from SSL_SESSION and use the version in SSL_HANDSHAKE everywhere. If resuming from a session then we need to use the SSL_SESSION cipher ID to set the SSL_HANDSHAKE cipher. And we still need to ensure that we update the cipher ID in the SSL_SESSION whenever the SSL_HANDSHAKE cipher changes (this only occurs in a few places). ok tb@
* Annotate issues with tls_session_secret_cb() related code.jsing2024-07-192-2/+15
|
* Move client ciphers from SSL_SESSION to SSL_HANDSHAKE.jsing2024-07-196-28/+26
| | | | | | | | SSL_SESSION has a 'ciphers' member which contains a list of ciphers that were advertised by the client. Move this from SSL_SESSION to SSL_HANDSHAKE and rename it to match reality. ok tb@
* Add RCS idtb2024-07-171-0/+1
|
* Enable regress for SSL_CIPHER_get_handshake_digest()jsing2024-07-171-4/+0
| | | | Turns out this is already linked statically.
* Rework cipher find test to also provide coverage for SSL_CIPHER_*()jsing2024-07-171-8/+754
|
* Update regress for removal of SSL_HANDSHAKE_MAC_DEFAULT.jsing2024-07-161-25/+2
|
* Clean up SSL_HANDSHAKE_MAC_DEFAULT.jsing2024-07-163-63/+39
| | | | | | | | | | The handshake MAC needs to be upgraded when TLSv1.0 and TLSv1.1 ciphersuites are used with TLSv1.2. Since we no longer support TLSv1.0 and TLSv1.1, we can simply upgrade the handshake MAC in the ciphersuite table and remove the various defines/macros/code that existed to handle the upgrade. ok tb@
* Fix .Ox for SSL_CIPHER_get_handshake_digest()tb2024-07-161-3/+3
|
* Switch the EVP_PKEY_*attr* API to LCRYPTO_UNUSED()tb2024-07-151-10/+10
| | | | This would have prevented the PKCS12 oopsie.
* Fix PKCS12_create()tb2024-07-151-6/+21
| | | | | | | | | | This tries to copy some microsoft attributes which are not usually present and chokes on the now disabled EVP_PKEY_*attr* API. Instead of reviving about four layers of traps and indirection, just inline the two functions in a way that should be more obvious. found by anton via the ruby-openssl tests ok jsing
* Mop up TLS1_PRF* defines.jsing2024-07-152-76/+67
| | | | | | | | These have not been used for a long time, however SSL_CIPHER was not opaque at the time, hence they had to stick around. Now that SSL_CIPHER is opaque we can simply mop them up. ok tb@
* fix signature of main()anton2024-07-151-4/+3
|
* enable warnings and apply a dash of knfmtanton2024-07-152-1/+2
|
* ocurred -> occurredjsg2024-07-151-3/+3
|
* Rewrite EVP_PKEY_add1_attr_by_NID()tb2024-07-141-11/+41
| | | | | | | Instead of jumping through many layers that cause headache, we can achieve the same in an entirely straightforward way without losing clarity. ok jsing
* Disable most EVP_PKEY_*attr* APItb2024-07-141-14/+17
| | | | | | | | There is a single consumer of this entire family of function, namely the openssl(1) pkcs12 command uses EVP_PKEY_add1_attr_by_NID, so leave that one intact for now. ok jsing
* Forgot to annotate the TMP UGLY CAST[S] as requested by jsingtb2024-07-141-1/+2
| | | | h/t to levitte
* Document SSL_CIPHER_get_handshake_digest(3)tb2024-07-141-2/+22
|
* Prepare to provide SSL_CIPHER_get_handshake_digest()tb2024-07-143-3/+23
| | | | | | | Needed by newer freeradius. This is a straightforward implementation that essentially duplicates tls13_cipher_hash(). ok jsing
* Remove lhash_local.h.jsing2024-07-144-99/+26
| | | | | | | | | lhash_local.h was previously needed since conf/conf_api.c and objects/obj_dat.c were fiddling with lhash internals when deleting via a callback. Since we no longer need to do that, inline the structs in lhash.c and remove the header. ok tb@
* Add wcsnlen(3), wcslen(3) with a max len argumentjca2024-07-143-7/+84
| | | | Missing function hit by fcambus@ some time ago. ok millert@
* Add elf_aux_info(3)jca2024-07-143-1/+59
| | | | | | | | Designed to let userland peek at AT_HWCAP and AT_HWCAP2 using an already existing interface coming from FreeBSD. Headers bits were snatched from there. Input & ok kettenis@ libc bump and sets sync will follow soon
* "please refer" -> "refer"jsg2024-07-141-3/+3
| | | | | missed in 2022 "remove please from manual pages" commit ok tb@
* ssl2.h and ssl23.h join the party in the attictb2024-07-135-257/+11
| | | | | | | Now that the SSL2 client hello support is gone, nothing uses this anymore, except that a few ports still need SSL2_VERSION. ok beck
* Make error constants const in libssltb2024-07-131-5/+5
| | | | | | | | This could be made cleaner if we expose ERR_load_const_strings(), but for now this hackier version with casts achieves the same and removes the last unprotected modifiable globals in this library. ok jsing
* Move the sigaction next to multitb2024-07-131-2/+2
| | | | Reduces diff in -portable
* Unify X.509v3 extension methodstb2024-07-1321-376/+691
| | | | | | | | | | | | Use C99 initializers for all structs (some were forgotten). Make all the structs static, call them x509v3_ext_* matching NID_*. Add accessors called x509v3_ext_method_* and use these to implement X509V3_EXT_get_nid(). This adds consistency and avoids a few contortions like grouping a few extensions in arrays to save a couple externs. ok beck jsing
* Fix the horrible and undocumented behaviour of X509_check_trustbeck2024-07-124-54/+73
| | | | | | | | | | | | | | | | | | | | Of allowing you to pass in a NID directly, instead of a trust_id, and have it work, as long as the trust_id's and the NID's did not overlap. This screwball behaviour was depended upon by the OCSP code that called X509_check_trust with the NID, instead of the trust id, so let's fix that. We also rename the confusingly named X509_TRUST_DEFAULT to X509_TRUST_ACCEPT_ALL which makes a lot more sense, and rototill this to remove the confusingly named static functions. This will shortly be follwed up by making this function private, so we have not bothered to fix the amazingly obtuse man page as it will be taken behind the barn at that time. ok tb@
* Clean up in X509_check_trust.beck2024-07-121-14/+8
| | | | | | | | | | | | | | | The XXX comment in here is now outdated. Our behaviour matches boringssl in that passing in a 0 trust gets the default behavior, which is to trust the certificate only if it has EKU any, or is self signed. Remove the goofy unused nid argument to "trust_compat" and rename it to what it really does, instead of some bizzare abstraction to something simple so the code need not change if we ever change our mind on what "compat" is for X.509, which will probably only happen when we are back to identifying things by something more sensible like recognizable grunts and smells. ok jsing@
* Drop the unused evp includetb2024-07-121-2/+1
|
* Rename the sk in this file to extstb2024-07-121-16/+16
|
* Avoid using ret for an X509_EXTENSIONtb2024-07-121-16/+16
| | | | | | | Instead rename the **ext in this file to **out_ext, freeing up ext in X509_EXTENSION_create_by_OBJ() Appeases some jsing grumbling on review
* Tweak variable names in X509v3_add_ext()tb2024-07-121-12/+12
| | | | | | x -> out_ext, sk -> exts requested by jsing on review
* Rename crit to critical in this filetb2024-07-121-10/+10
| | | | requested by jsing on review
* Simplify X509_EXTENSION_get_critical()tb2024-07-121-4/+3
| | | | | | This is a silly API, but there are worse. ok jsing
* Lose a few extra lines in X509_EXTENSION_set_object()tb2024-07-121-4/+2
| | | | ok jsing
* Streamline X509_EXTENSION_create_by_OBJ()tb2024-07-121-9/+10
| | | | ok jsing
* Clean up X509_EXTENSION_create_by_NID()tb2024-07-121-9/+5
| | | | | | | | Remove unnecessary ret parameter and freeing of obj (which looks like a double free or freeing of unallocated memory but actually isn't due to various magic flags). Also make this const correct. ok jsing
* Rewrite X509v3_add_ext()tb2024-07-121-24/+23
| | | | | | | | | | | | | This is another brilliancy straight out of muppet labs. Overeager and misguided sprinkling of NULL checks, going through the trademark poor code review, made this have semantics not matching what almost every other function with this signature would be doing in OpenSSL land. This is a long standing mistake we can't fix without introducing portability traps, but at least annotate it. Simplify the elaborate dance steps and make this resemble actual code. ok jsing
* Simplify X509v3_get_ext() and X509v3_delete_ext()tb2024-07-121-7/+1
| | | | | | Drop unnecessary checks that are part of the stack API. ok jsing
* Align X509v3_get_ext_by_critical() with X509v3_get_ext_by_OBJ()tb2024-07-121-12/+9
| | | | | | Plus, replace a manual check with a call to X509_EXTENSION_get_critical(). ok jsing
* Clean up X509v3_get_ext_by_OBJ()tb2024-07-121-11/+7
| | | | | | | | Like most of its siblings, this function can be simplified significantly by making proper use of the API that is being built. Drop unnecessary NULL checks and other weirdness and add some const correctness. ok jsing
* use sigaction() to setup SIGARLM so we can set SA_RESTART, andderaadt2024-07-121-6/+8
| | | | | | remove the re-arming in the handler. Better than using siginterrupt(), and avoids the errno saving requirement in the handler also. ok guenther millert
* Despite being an ELF citizen, hppa is its own special snowflake and requiresmiod2024-07-121-1/+5
| | | | | | different asm stanzas to produce strong aliases. This unbreaks libssl on hppa after the recent switch to LIBRESSL_NAMESPACE.
* Despite being an ELF citizen, hppa is its own special snowflake and requiresmiod2024-07-111-1/+5
| | | | | | | different asm stanzas to produce strong aliases. This unbreaks libcrypto (and thus ssh, among other things) on hppa after the recent switch to LIBRESSL_CRYPTO_NAMESPACE.
* Adjust regress to match changes in SSL_select_next_proto() argstb2024-07-111-123/+99
|
* Adjust documentation for SSL_select_next_proto()tb2024-07-111-30/+48
| | | | | | | | Use better argument names, add a link to the relevant standards and add CAVEATS and BUGS sections pointing out a few pitfalls. discussed with davidben ok beck
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-03 13:32:05 +0000