summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/malloc.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-06-13Add SSL_AD_MISSING_EXTENSION.jsing2-2/+9
This is an alert that was added in TLSv1.3 - we already use it internally, but did not provide the SSL_AD_* define previously. ok tb@
2021-06-13Define SSL_AD_* as actual values.jsing3-42/+49
Rather than having SSL_AD_* as defines that refer to SSL3_AD_* or TLS1_AD_*, just give them actual values directly since it is more readable and the indirection provides no value. Place SSL3_AD_* and TLS1_AD_* under #ifndef LIBRESSL_INTERNAL to prevent further usage. ok tb@
2021-06-13Remove tls1_alert_code().jsing3-73/+3
After running the preprocessor, this function becomes: switch (code) { case 0: return (0); case 10: return (10); case 20: return (20); ... } Its intended purpose was to prevent SSLv3 alerts being sent from TLS code, however now that we've removed "no_certificate" from LibreSSL's reach, it no longer does anything useful. ok tb@
2021-06-13Place obsolete alerts under #ifndef LIBRESSL_INTERNAL.jsing1-4/+7
ok tb@
2021-06-13Remove references to obsolete alerts.jsing2-26/+2
The "no_certificate" alert only existed in SSLv3, while the "decryption_failed" and "export_restriction" alerts were removed in TLSv1.1. ok tb@
2021-06-12space between macro args and punctuation;jmc2-13/+13
2021-06-12RFC 4507bis can refer to various RFCs but this instance is abouttb1-4/+5
RFC 5077. Note that session resumption via session tickets is only for TLSv1.2 and earlier. prompted by a question by/ok jmc
2021-06-11space between RFC and number;jmc7-29/+29
2021-06-11Only use SSL_AD_* internally.jsing3-88/+88
Due to hysterical raisins there are three different types of defines for alerts. SSL3_AD_* are from SSLv3, TLS1_AD_* are from TLSv1.0 onwards and SSL_AD_* currently map to either an SSL3_AD_* or TLS1_AD_* define. Currently, all three of these are used in various places - switch to using just SSL_AD_* values internally, as a first step in cleaning this up. ok tb@
2021-06-11add AES-GCM constants from RFC 7714 for SRTPlandry3-4/+20
SRTP_AEAD_AES_128_GCM/SRTP_AEAD_AES_256_GCM can be used as DTLS-SRTP protection profiles - seen with an update of telephony/baresip i'm working on. adapted from openssl commit 43e5faa2539ae8aae6ef55be2239b9b1a77fea45 ok tb@ jsing@
2021-06-11sync cert.pem with Mozilla's CA list generated from certdata.txtsthen1-476/+163
(certificates with the "server auth" trust purpose permitted). ok tb@ -AC Camerfirma S.A. - /C=EU/L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287/O=AC Camerfirma S.A./CN=Chambers of Commerce Root - 2008 - /C=EU/L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287/O=AC Camerfirma S.A./CN=Global Chambersign Root - 2008 - FNMT-RCM /C=ES/O=FNMT-RCM/OU=AC RAIZ FNMT-RCM + /C=ES/O=FNMT-RCM/OU=Ceres/2.5.4.97=VATES-Q2826004J/CN=AC RAIZ FNMT-RCM SERVIDORES SEGUROS -GeoTrust Inc. - /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA - /C=US/O=GeoTrust Inc./OU=(c) 2007 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G2 - GlobalSign nv-sa + /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Root E46 + /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Root R46 /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA Staat der Nederlanden /C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden EV Root CA - /C=NL/O=Staat der Nederlanden/CN=Staat der Nederlanden Root CA - G3 Unizeto Technologies S.A. /C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Trusted Network CA + /C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Trusted Network CA 2 - -VeriSign, Inc. - /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2008 VeriSign, Inc. - For authorized use only/CN=VeriSign Universal Root Certification Authority (Note, "Staat der Nederlanden Root CA - G3" was changed to email trust only, so is removed from this due to it only listing "server auth" purposes).
2021-06-11SSL3_AD_ILLEGAL_PARAMETER is not a valid SSLerror() reason code.jsing1-2/+2
Use SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER instead. ok tb@
2021-06-11Indent all labels with a single space.jsing11-44/+44
This ensures that diff reports the correct function prototype. Prompted by tb@
2021-06-09Enable libexecinfo regress.mortimer1-1/+4
2021-06-08Simplify tlsext_ecpf_parse()tb1-8/+4
The default alert in the tlsext parsing code is a decode_error, so there's no need for an error path that only sets that alert. suggested by/ok jsing
2021-06-08Rewrap a comment to avoid an overlong linetb1-3/+3
2021-06-08Ignore the record version for early alertstb1-4/+10
On receiving the first flight from the peer, we do not yet know if we are using TLSv1.3. In particular, we might get an alert record with record version 0x0300 from a pre-TLSv1.2 peer in response to our client hello. Ignore the record version instead of sending a protocol version alert in that situtation. This may also be hit when talking to a LibreSSL 3.3 server with an illegal SNI. Part of an issue reported by danj. ok jsing
2021-06-08TLSv1.3 server: avoid sending alerts in legacy recordstb1-3/+4
As soon as we know that we're dealing with a TLSv1.3 client, set the legacy version in the record layer to 0x0303 so that we send alerts with the correct record version. Previously we would send early alerts with a record version of 0x0300. ok jsing
2021-06-08Adjust alert for ECPF without uncompressed point formattb1-3/+4
According to RFC 8422, we must send an illegal_parameter alert on receiving an ECPF extension that doesn't include the uncompressed format, not a decode_error. Reported via GitHub issue #675. ok jsing
2021-06-08Fix pkg-config .pc files with LibreSSLinoguchi2-9/+7
In libssl.pc, Libs: should not have '-lcrypto', and Requires.private: should have it as 'libcrypto'. openssl.pc does not need Libs: and Cflags:, but should have Requires:. OK millert@
2021-06-01Update RFC reference. RFC 4366 was obsoleted by RFC 6066.tb1-2/+2
2021-06-01Avoid sending a trailing dot in SNI as a clienttb1-6/+19
While an FQDN includes a trailing dot for the zero-length label of the root, SNI explicitly does not contain it. Contrary to other TLS implementations, our tlsext_sni_is_valid_hostname() rejects a trailing dot. The result is that LibreSSL TLS servers encountering an SNI with trailing dot abort the connection with an illegal_parameter alert. This fixes an issue reported by danj in nc(1) and by sthen in ftp(1). DNS cluebat from florian. ok jsing
2021-06-01Remove unnecessary cast in free.tb1-2/+2
ok jsing
2021-05-31Since our unix receive queue got longer, the test run-t_sendrecvbluhm1-24/+30
did not terminate anymore on some machines. The test counts 100 send errors before it finishes. NetBSD has added sched_yield() in the receiver loop to trigger the errors on the sender side. Although not perfect, it works for me. Get current t_sendrecv.c from NetBSD.
2021-05-20EVP_Digest*: fix documented return values.tb2-10/+6
EVP_DigestSign{,Init,Update,Final}() and EVP_DigestVerify{Init,Update}() always returned 1 for success and 0 for failure. EVP_DigestVerify() and EVP_DigestVerifyFinal() can return -1 or -2, though. Based on OpenSSL 1.1.1 56c59ddd99da05c2f30832cccaffb873a8481555 ok inoguchi
2021-05-19Adjust libcrypto obj_xref.txt to obj_xref.hinoguchi1-2/+2
To generate current obj_xref.h, third item of lines id_tc26_signwithdigest_gost3410_2012_256/512 should be id_GostR3410_2001. obj_xref.txt r1.2 and obj_xref.h r1.3 were committed at the same time, and these third item were coded different value each other. This adjusts obj_xref.txt to current obj_xref.h. ok tb@
2021-05-16Absorb SSL_AEAD_CTX into struct tls12_record_protection.jsing3-73/+63
The information contained in SSL_AEAD_CTX really belongs in the tls12_record_protection struct. Absorb SSL_AEAD_CTX, using more appropriate types in the process. ok tb@
2021-05-16Zero the tls12_record_protection struct instead of individual fields.jsing1-9/+3
In tls12_record_protection_clear(), rather than zeroing or NULLing individual fields once a pointer has been freed, zero the entire struct once the pointers have been dealt with. ok tb@
2021-05-16Avoid including tls13_internal.h in tls13_record.h.jsing1-2/+1
While the implementation needs tls13_internal.h, consumers of tls13_record.h should not.
2021-05-16Avoid pulling ssl_locl.h into self-contained code.jsing4-8/+4
2021-05-16Make local header inclusion consistent.jsing18-51/+36
Consistently include local headers in the same location, using the same grouping/sorting across all files.
2021-05-16Move DTLS structs/definitions/prototypes to dtls_locl.h.jsing14-214/+282
Now that the DTLS structs are opaque, add a dtls_locl.h header and move internal-only structs from dtls1.h, along with prototypes from ssl_locl.h. Only pull this header in where DTLS code actually exists. ok inoguchi@ tb@
2021-05-16Add a missing space.jsing1-2/+2
2021-05-16Fix formatting of multi-line license comment per style(9).jsing4-8/+12
2021-05-16Avoid pulling ssl_sigalgs.h in via ssl_locl.h.jsing3-4/+7
Forward declare struct sigalg in ssl_locl.h and avoid including ssl_sigalgs.h. Explicitly include ssl_sigalgs.h where it is needed.
2021-05-16Remove unnecessary includes from the bytestring APIs.jsing4-14/+4
The bytestring APIs are self contained, hence including openssl headers here is unnecessary.
2021-05-16Explicitly include <openssl/opensslconf.h> in files using OPENSSL_NO_*jsing13-16/+30
Where a file references to OPENSSL_NO_* conditions, ensure that we explicitly include <openssl/opensslconf.h> before any references, rather than relying on another header to pull this in.
2021-05-14whitespace/KNFtb1-4/+4
2021-05-14Improve libcrypto obj_xref.h generatorinoguchi1-0/+4
Modify objxref.pl to output $OpenBSD$ header and __BEGIN_HIDDEN_DECLS / __END_HIDDEN_DECLS . ok and comment from tb@
2021-05-13Add missing .Pp in HISTORY section.tb2-4/+6
2021-05-13Add missing .Pptb1-2/+3
2021-05-12Merge documentation for SSL_CIPHER_find(3) from OpenSSL 1.1.1.tb1-2/+29
2021-05-12Install SSL_SESSION_get0_cipher.3tb1-1/+2