summaryrefslogtreecommitdiff
path: root/src/lib/libc/stdlib/system.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-09-16revert my putting this on a diet. sadly the NAME_CONSTRAINTS_checkbeck1-7/+1
symbol is exposed api and we probably need to deprecate it thoughtfully.
2020-09-16Group seal record functions together.jsing1-11/+11
No functional change.
2020-09-16Add cipher set tests with empty SSL_set_ciphersuites().jsing1-0/+22
2020-09-16Correct cipher_set_test() when run on a machine without AES acceleration.jsing1-1/+19
Noted by bcook@ and inoguchi@ while working on portable.
2020-09-16Make cipher_set_test() log failures and continue, rather than aborting.jsing1-11/+3
2020-09-16noop NAME_CONSTRAINTS_check stubinoguchi1-4/+5
On OSX and Windows platform portable build fails since it can't find NAME_CONSTRAINTS_check. It is still remain in x509v3.h and Symbols.list but '#if 0'ed from x509_ncons.c. In this situation, some platforms appears to get error. Add noop NAME_CONSTRAINTS_check stub to solve this issue. ok beck@
2020-09-16Let SSL_CTX_get_ciphers(NULL) return NULL rather than crashschwarze2-6/+7
for compatibility with OpenSSL and for consistency with neighbouring functions; suggested by jsing@ after i documented the crash; OK jsing@.
2020-09-16Mark SSL_get_cipher_list(3) as deprecated; it is badly misnamed, and thereschwarze1-4/+6
is already a comment above it in ssl_lib.c in both OpenSSL and LibreSSL: /* The old interface to get the same thing as SSL_get_ciphers(). */ Suggested by and OK jsing@.
2020-09-16Avoid memset() before memcpy() for CBB_add_bytes().jsing1-2/+2
CBB_add_bytes() calls CBB_add_space(), which now explicitly zeros memory to avoid information leaks. However CBB_add_bytes() calls memcpy() for the same memory region, so the memset() is unnecessary. Avoid this by inlining part of CBB_add_space() rather than calling it directly. ok beck@ tb@
2020-09-16Make check in x509_verify_ctx_set_max_signatures() consistent with others.jsing1-4/+2
ok beck@
2020-09-16Dedup code in x509_verify_ctx_new_from_xsc().jsing1-14/+7
Rather than duplicating code, have x509_verify_ctx_new_from_xsc() call x509_verify_ctx_new(), then handle the xsc specific parts. ok beck@
2020-09-15The undocumented public function SSL_set_SSL_CTX(3) changes theschwarze1-4/+4
context used by an SSL object, so do not talk about the SSL_CTX that "an SSL object was created from"; fixing an inaccuracy pointed out by jsing@.
2020-09-15Split the tls12_record_layer_write_mac() function.jsing1-10/+19
Split the existing tls12_record_layer_write_mac() function so that we can soon reuse part of it for the read side. No functional change. ok tb@
2020-09-15Do not destroy an existing cipher list when ssl_parse_ciphersuites()schwarze1-4/+2
fails, to match the behaviour of ssl_create_cipher_list(). This also agrees with the behaviour of SSL_set_ciphersuites(3) in OpenSSL. Issue found while writing documentation. OK jsing@
2020-09-15Correct a failure case in tls12_record_layer_seal_record_protected()jsing1-2/+2
This should be a 'goto err' rather than returning.
2020-09-15Create the missing RETURN VALUES section and move the appropriateschwarze1-57/+103
content there. Clarify when the returned pointers become invalid, which is far from obvious but sets surprising traps for the user. For three of the functions, correct statements about when they fail. Also improve a number of wordings while here. OK beck@
2020-09-15set error_depth and current_cert to make more legacy callbacks that don't checkbeck1-1/+3
happy ok tb@
2020-09-15Deduplicate the time validation code between the legacy and newbeck3-27/+8
verification code. ok jsing@
2020-09-15ifdef out code that is no longer used in here. once we are certainbeck1-2/+5
of staying with the new name constraint code this will be deleted ok jsing@
2020-09-15Cleanup/simplify SSL_set_ssl_method().jsing1-18/+18
In particular, figure what the handshake_func should be early on, so we can just assign later. ok beck@
2020-09-15Mop up the get_ssl_method function pointer.jsing2-50/+2
Now that get_ssl_method is no longer used, we can garbage collect the function pointer and some associated machinery. ok beck@
2020-09-15Test botan TLS client with libressl, openssl, openssl11 server.bluhm4-6/+305
2020-09-14Move state initialisation from SSL_clear() to ssl3_clear().jsing2-4/+4
If we use the default method (now TLSv1.3) and end up talking to a TLSv1.2 server that gives us a session ticket, then try to resume that session, we end up trying to talk TLS without doing a handshake. This is caused by the state (S3I(s)->hs.state) getting cleared, which results in SSL_do_handshake() and others thinking they do not need to do anything (as SSL_in_init() and SSL_in_before() are not true). The reason this occurs is due to SSL_set_ssl_method() calling ssl_free() and ssl_new() when switching methods. The end result is that the S3I(s) has been freed and reallocated, losing the state in the process. Since the state is part of the S3I(s) structure, move its initialisation into ssl3_clear() - this ensures it gets correctly reinitialised across a SSL_set_ssl_method() call. Issue noticed by sthen@ with nginx and unifi. ok beck@ tb@
2020-09-14Cleanup and simplify SSL_set_session().jsing1-36/+22
SSL_set_ssl_method() checks to see if the method is already the same, so we do not need to do this check in three different places. Switch to dtls1_get_client_method()/tls1_get_client_method() to find the method - this is a slight change in behaviour, however there is not much point trying to resume a session on something other than a client. ok beck@
2020-09-14Avoid NULL deref SSL_{,CTX_}set_ciphersuitestb1-2/+2
Move assignment to the correct place so that the run continuation condition actually checks what it is supposed to. Found by getting lucky when running regress. ok beck jsing
2020-09-14simplify RETURN VALUES for x509_verify(3) after beck@ made the rulesschwarze1-7/+3
simpler and more consistent in x509_verify.c rev. 1.6; OK beck@