| Commit message (Collapse) | Author | Files | Lines | ||
|---|---|---|---|---|---|
| 2015-10-16 | Fix tpyo. | jsing | 1 | -3/+3 | |
| 2015-10-16 | Implement real "flock" request and add it to userland programs that | millert | 1 | -2/+2 | |
| use pledge and file locking. OK deraadt@ | |||||
| 2015-10-16 | actually include the prerequisite dependency for BIO instead of doing nastyness | beck | 2 | -10/+4 | |
| 2015-10-14 | better fix for overrun reported by Qualys Security. | tedu | 2 | -8/+2 | |
| buf is at all times kept nul terminated, so there is no need to enforce this again upon exit. (no need to move buf around after we exahust space.) ok beck miod | |||||
| 2015-10-14 | Bail out early if we have no buf_len | beck | 2 | -2/+10 | |
| ok miod@ | |||||
| 2015-10-14 | fix a memory leak reported by Qualys Security. | tedu | 2 | -6/+8 | |
| move the bndec variable in tighter since it's not used elsewhere in the loop, then always free it after use. ok bcook miod | |||||
| 2015-10-14 | Ensure we don't write a 0 byte past end of the buffer in the error case. | beck | 2 | -6/+6 | |
| ok bcook@ deraadt@ | |||||
| 2015-10-14 | tweak previous (two details i apparently missed) | schwarze | 1 | -4/+6 | |
| 2015-10-14 | Add EVP_AEAD_CTX_init(3) manpage to document the new(ish) AEAD API. | reyk | 4 | -1/+285 | |
| The "authenticated encryption with additional data" API is used for ciphers like AES-GCM or ChaCha20-Poly1305. The manpage is a beginning and certainly needs more work, especially improvements in the EXAMPLES section. Based on agl's source code comments. Converted from pod to mandoc by schwarze@ OK schwarze@ jsing@ | |||||
| 2015-10-13 | In rev 1.15 the sizeof argument was fixed in a strlcat() call but | millert | 1 | -2/+2 | |
| the truncation check immediately following it was not updated to match. Not an issue in practice since the buffers are the same size. OK deraadt@ | |||||
| 2015-10-13 | Put ASN1_dup() under #ifndef LIBRESSL_INTERNAL. | jsing | 2 | -10/+10 | |
| 2015-10-13 | Convert ECParameters_dup() from a macro that uses ASN1_dup_of() into an | jsing | 6 | -10/+40 | |
| actual function. This removes the last ASN1_dup_of usage from the tree. Feedback from doug@ and miod@ | |||||
| 2015-10-13 | Convert a number of the old ASN1_{d2i,i2d}_{bio,fp}_of() macros to | jsing | 2 | -38/+38 | |
| ASN1_item_{d2i,i2d}_{bio,fp}() function calls. ok beck@ doug@ | |||||
| 2015-10-13 | Single byte read/write tests. | jsing | 1 | -0/+67 | |
| 2015-10-13 | Add test coverage for peer certificate info and connection info. | jsing | 2 | -6/+231 | |
| 2015-10-13 | Make regress work again post hackathon tls_handshake/tls_read/tls_write | jsing | 1 | -7/+42 | |
| changes. | |||||
| 2015-10-13 | Group d2i/i2d function prototypes by type and add missing externs for the | jsing | 2 | -14/+24 | |
| DSAPublicKey, DSAPrivateKey and DSAparams ASN1_ITEMs. | |||||
| 2015-10-12 | unifdef EVP_CHECK_DES_KEY: Ben Kaduk noticed it has a syntax error; that | guenther | 4 | -40/+4 | |
| error was present in the original 2004 commit, so it hasn't been used in over 11 years, thus exceeding our deprecation requirements by over a decade. OpenSSL has chosen to *fix it*; we'll gladly watch it burn ok jsing@ | |||||
| 2015-10-11 | Userspace doesn't need to use SUN_LEN(): connect() and bind() must accept | guenther | 1 | -8/+3 | |
| sizeof(struct sockaddr_un), so do the simple, portable thing ok beck@ deraadt@ | |||||
| 2015-10-10 | Initial support for pledges in openssl(1) commands. | doug | 47 | -46/+281 | |
| openssl(1) has two mechanisms for operating: either a single execution of one command (looking at argv[0] or argv[1]) or as an interactive session than may execute any number of commands. We already have a top level pledge that should cover all commands and that's what interactive mode must continue using. However, we can tighten up the pledges when only executing one command. This is an initial stab at support and may contain regressions. Most commands only need "stdio rpath wpath cpath". The pledges could be further restricted by evaluating the situation after parsing options. deraadt@ and beck@ are roughly fine with this approach. | |||||
| 2015-10-10 | normalize the ordering of tame requests (particularily, "rpath wpath cpath", | deraadt | 1 | -2/+2 | |
| which i have put in that order). this is not important, but helps look for outliers which might be strange. it hints that "ioctl" should be reassessed in a few places, to see if "tty" is better; that "unix" may be used in some places where "route" could now work. | |||||
| 2015-10-09 | fix a gotcha in the connect refactoring, that could result in dropping | deraadt | 1 | -1/+5 | |
| through and trying to bind failed v6 connects. ok guenther | |||||
| 2015-10-09 | Change all tame callers to namechange to pledge(2). | deraadt | 1 | -3/+3 | |
| 2015-10-08 | If getaddrinfo() succeeds, then don't try look ups with other flags, even | guenther | 1 | -41/+39 | |
| if the connect()s failed. In concert with some resolver fixes in libc, this lets ntpd be tame()ed problem isolated by theo, who had fun untangling the libc and libtls behaviors to place blame for not being able to tame ntpd ok beck@ deraadt@ jsing@ | |||||
| 2015-10-08 | trailing whitespace; | jmc | 1 | -6/+6 | |
| 2015-10-08 | Rip the guts out of another gibbering horror of a time comparison function, and | beck | 4 | -74/+48 | |
| mark it as #ifndef LIBRESSL_INTERNAL at least we don't use this. ok jsing@ | |||||
| 2015-10-08 | revert previous accidental commit | beck | 4 | -46/+72 | |
| 2015-10-08 | Spelling in comment | beck | 6 | -78/+50 | |
| 2015-10-07 | Add tls_peer_cert_notbefore and tls_peer_cert_notafter to expose peer ↵ | beck | 6 | -9/+98 | |
| certificate validity times for tls connections. ok jsing@ | |||||
| 2015-10-07 | Allow us to get cipher and version even if there is not a peer certificate. | beck | 2 | -15/+21 | |
| ok doug@ | |||||
| 2015-10-07 | include <sys/time.h> for gettimeofday(2) | bcook | 2 | -2/+4 | |
| 2015-10-07 | tame "stdio inet rpath cpath wpath proc" seems to be sufficient for | deraadt | 1 | -1/+7 | |
| all the wading in here. "proc" is for the speed command, which fork()'s. ok doug | |||||
| 2015-10-06 | prefer limits.h over sys/limits.h | bcook | 2 | -6/+6 | |
| ok deraadt@ | |||||
| 2015-10-06 | these do not use ioctl.h | deraadt | 2 | -4/+2 | |
| 2015-10-05 | Make sure dot is not set after tz - fixes incorrect handling, which allows | jsing | 2 | -4/+4 | |
| 20151005171301+1.09Z to be treated as a valid time. ok beck@ | |||||
| 2015-10-05 | Wrap <resolv.h> so that internal calls go direct | guenther | 3 | -5/+11 | |
| ok millert@ | |||||
| 2015-10-04 | Apply some style(9), tweak a few things for readability and add some | jsing | 2 | -72/+80 | |
| additional bounds checks. ok beck@ | |||||
| 2015-10-04 | wrap __ivaliduser_sa() so the internal call is direct (at least until we | guenther | 1 | -0/+2 | |
| stop exporting it) | |||||
| 2015-10-04 | recv() and send() aren't overriden by libpthread (vs recvfrom() and sendto()!) | guenther | 2 | -2/+4 | |
| so wrap them to make internal calls go direct | |||||
| 2015-10-03 | SSL_new(): fix ref counting and memory leak in error path. | doug | 2 | -16/+6 | |
| Rather than a half-hearted attempt to free up resources and fix ref counting at the SSL_CTX level, let SSL_free() do its job. This diff got lost in the shuffle somewhere. It's from last year. Ref counting error reported by Parakleta in github ticket #51. Thanks! ok jsing@, beck@ | |||||
| 2015-10-03 | BIO_get_fd() could return fd 0; fix error condition. Found at | deraadt | 1 | -2/+2 | |
| http://marc.info/?l=openssl-dev&m=144374015404899&w=2 ok doug | |||||
| 2015-10-02 | avoid sys/param.h, by using PATH_MAX | deraadt | 1 | -1/+1 | |
| 2015-10-02 | Add another invalid time, which is currently accepted. | jsing | 1 | -1/+4 | |
| 2015-10-02 | Flense the greasy black guts of unreadble string parsing code out of three areas | beck | 15 | -543/+666 | |
| in asn1 and x509 code, all dealing with an ASN1_TIME. This brings the parsing together in one function that converts into a struct tm. While we are at it this also brings us into conformance with RFC 5280 for times allowed in an X509 cert, as OpenSSL is very liberal with what it allows. input and fixes from deraadt@ jsing@ guethther@ and others. ok krw@, guenther@, jsing@ | |||||
| 2015-10-02 | s/ssl3_client_kex/ssl3_send_client_kex/ for consistency with the caller. | jsing | 2 | -18/+22 | |
| 2015-10-01 | include <sys/types.h> for ssize_t | bcook | 1 | -1/+3 | |
| ok jsing@, deraadt@ | |||||
| 2015-10-01 | Another s/M_ASN1_INTEGER_free/ASN1_INTEGER_free/. | jsing | 1 | -2/+2 | |
| Found the hard way by Mark Patruck. | |||||
| 2015-10-01 | Eliminate the last of the LINTEDn and PRINTFLIKEn comments. In one | guenther | 6 | -15/+7 | |
| case, by deleting some useless '& of an array' we also eliminate the need for the casts which prompted the original lint warnings ok deraadt@ | |||||
| 2015-09-30 | Place all of the ASN1 M_ macros under #ifndef LIBRESSL_INTERNAL. | jsing | 2 | -60/+74 | |
| 2015-09-30 | Expand M_i2d_ASN1_OCTET_STRING macros - no change in generated assembly, | jsing | 2 | -6/+10 | |
| aside from line numbers. | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |