| Commit message (Collapse) | Author | Files | Lines | ||
|---|---|---|---|---|---|
| 2016-10-20 | canary corruption message changed a bit | otto | 1 | -5/+5 | |
| 2016-10-20 | Also place canaries in > page sized objects (if C is in effect); ok tb@ | otto | 1 | -103/+110 | |
| 2016-10-19 | unifdef OPENSSL_NO_CMS | jsing | 8 | -123/+8 | |
| 2016-10-19 | Update client hello messages to follow the removal of fixed ECDH. | jsing | 1 | -89/+65 | |
| 2016-10-19 | Remove support for fixed ECDH cipher suites - these is not widely supported | jsing | 7 | -466/+42 | |
| and more importantly they do not provide PFS (if you want to use ECDH, use ECDHE instead). With input from guenther@. ok deraadt@ guenther@ | |||||
| 2016-10-19 | Remove the save_errno dance inside strerror_r(3). It is from the | bluhm | 1 | -5/+3 | |
| time when we had national language support. OK millert@ | |||||
| 2016-10-17 | If BN_div_word() fails (by returning (BN_ULONG)-1) or if the division | guenther | 1 | -4/+8 | |
| fails to reduce the input in the expected space then fail out instead of overflowing the allocated buffer. combines openssl commits 28a89639da50b1caed4ff3015508f23173bf3e49 and 3612ff6fcec0e3d1f2a598135fe12177c0419582 ok doug@ beck@ | |||||
| 2016-10-16 | Move libcrypto, librpcsvc and gnu/usr.bin/cc/include from RDIRS to PRDIRS, | tb | 1 | -2/+4 | |
| and add prereq targets, so some header files are generated by BUILDUSER during 'make prereq' instead of by root during 'make includes'. Switch the order of 'make cleandir' and 'make includes' during 'make build' so we don't generate many files twice. Except for some machine@ symlinks from ${MACHINE}/stand, /usr/obj is now clean from files generated by root during 'make build'. Those will be cleaned up in a second step. help, testing & ok deraadt, input from natano, further testing rpe | |||||
| 2016-10-16 | Roll back uintptr_t cast changes after discussions with tedu, otto and | dtucker | 3 | -24/+7 | |
| others. C11 6.5.6.9 says: When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object; the result is the difference of the subscripts of the two array elements. In these cases the objects are arrays of char so the result is defined, and we believe that the report is based on a compiler incorrectly trapping on defined behaviour. | |||||
| 2016-10-15 | Wrap _malloc_init() so internal calls go directly | guenther | 2 | -2/+6 | |
| prodded by otto@ ok kettenis@ otto@ | |||||
| 2016-10-14 | Cast pointers to uintptr_t to avoid potential signedness errors. | dtucker | 3 | -7/+24 | |
| Based on patch from yuanjie.huang at windriver.com via OpenSSH bz#2608, with & ok millert, ok deraadt. | |||||
| 2016-10-14 | 0xd0 -> 0xdb; ok deraadt@ millert@ tedu@ | otto | 1 | -3/+3 | |
| 2016-10-12 | optimize canary code a bit by storing offset of sizes table instead of | otto | 1 | -5/+7 | |
| recomputing it all the time | |||||
| 2016-10-08 | make clear the length printed is the requested length | otto | 1 | -3/+3 | |
| 2016-10-07 | grammar fix previous; | jmc | 1 | -2/+2 | |
| 2016-10-07 | document "chunk canary corrupted" error | otto | 1 | -2/+7 | |
| 2016-10-07 | stray tab | otto | 1 | -2/+2 | |
| 2016-10-07 | Beter implementation of chunk canaries: store size in chunk meta data | otto | 1 | -61/+63 | |
| instead of chunk itself; does not change actual allocated size; ok tedu@ | |||||
| 2016-10-06 | typo | naddy | 1 | -3/+3 | |
| 2016-10-05 | Fix some broken .Xr links, loosely based on a diff | schwarze | 1 | -13/+12 | |
| from Rob Pierce <rob at 2keys dot ca>. The content of this page may also need expert attention, i suspect it may be lacking modern algorithms and over-emphasizing obsolete ones, but i dare not touch the content. | |||||
| 2016-10-03 | use the same type for buf as the return type in tls_load_file | bcook | 1 | -2/+3 | |
| ok tedu@, noted by kinichiro | |||||
| 2016-10-02 | Check for and handle failure of HMAC_{Update,Final} or EVP_DecryptUpdate() | guenther | 1 | -5/+11 | |
| based on openssl commit a5184a6c89ff954261e73d1e8691ab73b9b4b2d4 ok bcook@ | |||||
| 2016-10-02 | Detect zero-length encrypted session data early, instead of when malloc(0) | guenther | 1 | -2/+2 | |
| fails or the HMAC check fails. Noted independently by jsing@ and Kurt Cancemi (kurt (at) x64architecture.com) ok bcook@ | |||||
| 2016-10-02 | In X509_cmp_time(), pass asn1_time_parse() the tag of the field being | guenther | 1 | -2/+3 | |
| parsed so that a malformed GeneralizedTime field is recognized as an error instead of potentially being interpreted as if it was a valid UTCTime. Reported by Theofilos Petsios (theofilos (at) cs.columbia.edu) ok beck@ tedu@ jsing@ | |||||
| 2016-09-23 | Append to CLEANFILES instead of replacing it, so libcrypto.pc is | natano | 1 | -2/+2 | |
| deleted on make clean. ok millert | |||||
| 2016-09-22 | trim STANDARDS; ok jsinglibressl-v2.5.0 | jmc | 1 | -13/+1 | |
| 2016-09-22 | some minor cleanup; | jmc | 1 | -47/+17 | |
| 2016-09-22 | shorten x509; | jmc | 1 | -755/+414 | |
| 2016-09-22 | Improve on code from the previous commit. | jsing | 1 | -7/+5 | |
| ok bcook@ | |||||
| 2016-09-22 | Avoid unbounded memory growth, which can be triggered by a client | jsing | 1 | -9/+20 | |
| repeatedly renegotiating and sending OCSP Status Request TLS extensions. Fix based on OpenSSL. | |||||
| 2016-09-22 | Check for packet with truncated DTLS cookie. | guenther | 1 | -12/+17 | |
| Flip pointer comparison logic to avoid beyond-end-of-buffer pointers to make it less likely a compiler will decide to screw you. Based on parts of openssl commits 6f35f6deb5ca7daebe289f86477e061ce3ee5f46 and 89c2720298f875ac80777da2da88a64859775898 ok jsing@ | |||||
| 2016-09-22 | Improve ticket validity checking when tlsext_ticket_key_cb() callback | guenther | 1 | -4/+25 | |
| chooses a different HMAC algorithm. Avert memory leaks if the callback preps the HMAC in some way. Based on openssl commit 1bbe48ab149893a78bf99c8eb8895c928900a16f but retaining a pre-callback length check to guarantee the callback is provided the buffer that the API claims. ok bcook@ jsing@ | |||||
| 2016-09-22 | revert documentation update for the clearning behavior we already reverted | bcook | 1 | -5/+1 | |
| 2016-09-21 | Delete casts to off_t and size_t that are implied by assignments | guenther | 6 | -20/+19 | |
| or prototypes. Ditto for some of the char* and void* casts too. verified no change to instructions on ILP32 (i386) and LP64 (amd64) ok natano@ abluhm@ deraadt@ millert@ | |||||
| 2016-09-20 | shorten version; | jmc | 1 | -17/+4 | |
| 2016-09-20 | shorten the verify error list; | jmc | 1 | -42/+41 | |
| 2016-09-20 | Avoid selecting weak digests for (EC)DH when using SNI. | bcook | 1 | -3/+12 | |
| from OpenSSL: SSL_set_SSL_CTX is normally called for SNI after ClientHello has received and the digest to use for each certificate has been decided. The original ssl->cert contains the negotiated digests and is now copied to the new ssl->cert. noted by David Benjamin and Kinichiro Inoguchi | |||||
| 2016-09-19 | put the spkac section in the right place; | jmc | 1 | -60/+60 | |
| 2016-09-19 | shorten verify; | jmc | 1 | -154/+96 | |
| 2016-09-19 | Update ld search path for libssl/libcrypto, fixes cross-build after source ↵ | bcook | 2 | -6/+6 | |
| moved. from Patrick Wildt | |||||
| 2016-09-18 | move page junking tp unmap(), right before we stick the region in the cache; | otto | 1 | -6/+6 | |
| ok tedu@ | |||||
| 2016-09-17 | remove comment about CMS; ok jsing | deraadt | 1 | -3/+2 | |
| 2016-09-15 | add some Xr for acme-client(1); | jmc | 1 | -1/+2 | |
| 2016-09-15 | some spkac shortening; ok beck | jmc | 1 | -68/+13 | |
| 2016-09-15 | shorten ts; | jmc | 1 | -283/+63 | |
| 2016-09-14 | Set callbacks on the right tls ctx on accept. | bcook | 1 | -2/+2 | |
| From Tobias Pape | |||||
| 2016-09-14 | Handle the FLUSH BIO cntl, that happens at the end of SSL handshakes. | bcook | 1 | -1/+2 | |
| from Tobias Pape | |||||
| 2016-09-14 | Allow callback read/write functions to set TLS_WANT_POLLOUT/POLLIN. | bcook | 1 | -3/+21 | |
| from Tobias Pape | |||||
| 2016-09-14 | Generate pkg-config files at build time like everything else. This | natano | 2 | -4/+6 | |
| avoids permission problems due to the build and install stages being run by different users. ok deraadt jasper | |||||
| 2016-09-13 | add a little more typing to the first callback argument. | tedu | 2 | -7/+7 | |
| it's always a tls context. | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |