openbsd - A mirror of https://github.com/libressl/openbsd.git

	Commit message (Collapse)	Author	Files	Lines
2017-08-12	New manual page SSL_set_tmp_ecdh(3) written from scratch.	schwarze	4	-7/+112
	Feedback and OK jsing@.
2017-08-12	Remove lots of outdated information found by jsing@.	schwarze	1	-192/+14
	OK jsing.
2017-08-12	Document tls_config_set_dheparams().	jsing	1	-4/+13

2017-08-12	Document tls_reset().	jsing	1	-2/+13

2017-08-12	Update the TLSv1.2 Client Hello messages, due to the removal of DSA	jsing	1	-20/+18
	sigalgs.
2017-08-12	Remove support for DSS/DSA, since we removed the cipher suites a while	jsing	9	-85/+16
	back. ok guenther@
2017-08-12	Clear the child pointer in CBB_cleanup(), so that we have fewer pointers	jsing	1	-1/+2
	hanging around to potentially invalid address space. Discussed with beck@ and doug@
2017-08-11	remove bogus ".POD" from .Dt name; noticed by jsing@	schwarze	1	-3/+3

2017-08-11	Be consistent with goto labels, failure flag and use of FAIL macro.	jsing	1	-128/+105

2017-08-11	doug@ added code in here as well.	jsing	1	-1/+2

2017-08-11	Sort by extension/function name.	jsing	1	-577/+576

2017-08-11	I don't think eay will ever fix this...	jsing	1	-2/+2

2017-08-11	style(9) in ssl_set_cert_masks().	jsing	1	-7/+7

2017-08-11	Rewrite EllipticCurves TLS extension handling using CBB/CBS and the new	doug	5	-77/+472
	extension framework. input + ok jsing@
2017-08-11	Convert ssl3_send_certificate_request() to CBB.	jsing	3	-63/+73
	ok beck@ doug@
2017-08-11	new sentence, new line;	jmc	1	-3/+4

2017-08-11	Add doug@'s copyright since he just added code to these two files.	jsing	2	-2/+4

2017-08-11	Bump minor due to symbol addition.	jsing	1	-1/+1
	Prompted by jsg@, since I apparently left it sitting in my tree...
2017-08-11	Rewrite the ECPointFormats TLS extension handling using CBB/CBS and the	doug	5	-148/+595
	new extension framework. input + ok jsing@
2017-08-10	Add a tls_config_set_ecdhecurves() function to libtls, which allows the	jsing	7	-34/+108
	names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@
2017-08-10	Clean up the EC key/curve configuration handling.	jsing	7	-120/+54
	Over the years OpenSSL grew multiple ways of being able to specify EC keys (and/or curves) for use with ECDH and ECDHE key exchange. You could specify a static EC key (SSL{_CTX,}_set_tmp_ecdh()), use that as a curve and generate ephemeral keys (SSL_OP_SINGLE_ECDH_USE), provide the EC key via a callback that was provided with insufficient information (SSL{_CTX,}_set_tmp_ecdh_cb()) or enable automatic selection and generation of EC keys via SSL{_CTX,}_set_ecdh_auto(). This complexity leads to problems (like ECDHE not being enabled) and potential weird configuration (like being able to do ECDHE without the ephemeral part...). We no longer support ECDH and ECDHE can be disabled by removing ECDHE ciphers from the cipher list. As such, permanently enable automatic EC curve selection and generation, effectively disabling all of the configuration knobs. The only exception is the SSL{_CTX,}_set_tmp_ecdh() functions, which retain part of their previous behaviour by configuring the curve of the given EC key as the only curve being enabled. Everything else becomes a no-op. ok beck@ doug@
2017-08-10	first draft of tests for newlocale(3), duplocale(3), uselocale(3)	schwarze	2	-0/+268

2017-08-09	Pull out the code that identifies if we have an ECC cipher in the cipher	jsing	3	-34/+52
	list or if we are negotiating an ECC cipher in the handshake. This dedups some of the existing code and will make the EC extension rewrites easier. ok doug@
2017-08-09	Don't use tls_cert_hash for the hashing used by the engine offloading magic	claudio	3	-11/+24
	for the TLS privsep code. Instead use X509_pubkey_digest() because only the key should be used as identifier. Relayd is rewriting certificates and then the hash would change. Rename the hash is struct tls_keypair to pubkey_hash to make clear what this hash is about. With input and OK jsing@
2017-08-09	Consistently return from each SSL/SSL_CTX control case, rather than	jsing	1	-33/+27
	breaking from some and returning from others.
2017-08-09	Split out the remaining SSL_CTX controls into individual functions.	jsing	1	-40/+88

2017-08-09	Start splitting out SSL_CTX controls into individual functions, so that	jsing	1	-71/+92
	they can eventually be exposed as direct functions/symbols.
2017-08-09	Be consistent and return from each SSL control case, rather than breaking	jsing	1	-18/+10
	from some.
2017-08-09	Split out the remaining SSL controls into individual functions.	jsing	1	-46/+93

2017-08-09	Split more controls into individual functions.	jsing	1	-64/+91

2017-08-09	Start splitting out controls into individual functions, so that they can	jsing	1	-29/+63
	eventually be exposed as direct functions/symbols.
2017-08-09	Remove unnecessary curly braces and unindent. Also add a few blank lines	jsing	1	-11/+13
	for readability.
2017-08-09	Fix conditionals for DH controls.	jsing	1	-3/+3

2017-08-01	add missing and correct misspelled names, most in NAME sections;	schwarze	10	-33/+45
	found with regress/usr.bin/mandoc/db/dbm_dump; OK jmc@
2017-08-01	correct function name;	jmc	1	-3/+3
	from carlos cardenas
2017-07-27	Sort subdir, run getaddrinfo test, remove vax case.	bluhm	1	-13/+21

2017-07-27	Sort expected getaddrinfo output in inet4 inet6 order, then the	bluhm	2	-46/+37
	test passes.
2017-07-27	Fix all clang warnings in libc regress and cleanup some make files.	bluhm	18	-75/+67

2017-07-27	Mark the invalid memory location as volatile, otherwise clang would	bluhm	1	-2/+2
	optimize the access to it with an illegal instruction. But the tests needs a SIGSEGV, it would fail with SIGILL.
2017-07-25	as noted by Hanno Boeck, using the *check_private_key functions is	benno	1	-6/+22
	tricky, especially since the manpage is full of lies. Try to make readers think twice before using them. With oks and help from schwarze@, tedu@, sthen@, jmc@
2017-07-24	Extend the SNI tests to ensure that we have a hostname in the session	jsing	1	-2/+31
	after a successful tlsext_sni_serverhello_parse() and that tlsext_sni_clienthello_parse() fails if we have an existing session and the SNI is mismatched.
2017-07-24	Rewrite and move the last remnants of the ServerHello SNI handling into	jsing	2	-29/+25
	tlsext_sni_serverhello_parse(). This also adds a check to ensure that if we have an existing session, the name matches what we specified via SNI. ok doug@
2017-07-24	Add regress coverage for the TLS Renegotiation Indication extension.	jsing	1	-1/+266

2017-07-24	Rewrite the TLS Renegotiation Indication extension handling using CBB/CBS	jsing	6	-346/+161
	and the new extension framework. Feedback from doug@ ok inoguchi@
2017-07-23	Hook the TLS extension parsing framework into the serverhello parsing.	jsing	1	-1/+6
	Missed in the original commit.
2017-07-22	zap trailing whitespace;	jmc	1	-2/+2

2017-07-22	rework the page a bit, clarify a few things, maybe better wording	tedu	1	-8/+13

2017-07-20	Allow leading . in nameConstraints. from openssl via jabberwock. ok jsing	tedu	1	-2/+2

2017-07-19	Check the return value of CBB_init_fixed(), since it can fail.	jsing	1	-3/+5

2017-07-16	Provide a new regress test for TLS extension handlers, currently covering	jsing	3	-1/+256
	the newly converted SNI code.