summaryrefslogtreecommitdiff
path: root/src/lib/libssl/s3_lib.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* This commit was manufactured by cvs2git to create tag 'OPENBSD_5_8_BASE'.OPENBSD_5_8_BASEcvs2svn2015-08-021-2860/+0
|
* Crank major and remove legacy variables.doug2015-07-191-4/+1
| | | | | | Libtls is riding this crank. ok miod@ bcook@
* Remove compat hack that disabled ECDHE-ECDSA on OS X.doug2015-07-171-9/+1
| | | | | | | | | For a few old releases, ECDHE-ECDSA was broken on OS X. This option cannot differentiate between working and broken OS X so it disabled ECDHE-ECDSA support on all OS X >= 10.6. 10.8-10.8.3 were the faulty releases but these are no longer relevant. Tested on OS X 10.10 by jsing. ok jsing@
* Convert ssl3_get_cipher_by_char to CBS.doug2015-07-141-2/+8
| | | | ok miod@ jsing@
* Make SSL_CIPHER_get_bits() report ChaCha20-Poly1305 ciphers as usingguenther2015-05-251-4/+4
| | | | | | | 256bit keys problem noted by Tim Kuijsten (info (at) netsend.nl) ok deraadt@ miod@ bcook@
* Rely upon enc_flags rather than the tls version, to upgrade SHA1+MD5 tomiod2015-02-081-4/+4
| | | | | SHA256 in ssl_get_algorithm2(). From OpenSSL HEAD; ok jsing@
* Clean up the {get,put}_cipher_by_char() implementations. Also usejsing2015-02-071-17/+6
| | | | | | | ssl3_get_cipher_by_value() in other parts of the code where it simplifies things. ok doug@
* Provide a SSL_CIPHER_get_by_value() function that allows a cipher to bejsing2015-02-071-1/+8
| | | | | | | | | | | | | | retrieved via its cipher suite value. A corresponding SSL_CIPHER_by_value() function returns the cipher suite value for a given SSL_CIPHER. These functions should mean that software does not need to resort to put_cipher_by_char()/get_cipher_by_char() in order to locate a cipher. Begrudgingly also provide a SSL_CIPHER_get_by_id() function that locates a cipher via the internal cipher identifier. Unfortunately these have already been leaked outside the library via SSL_CIPHER_by_id() and the various SSL3_CK_* and TLS1_CK_* defines in the ssl3.h/tls1.h headers. ok beck@ miod@
* Bring back the horrible API that is get_cipher_by_char/put_cipher_by_char.jsing2015-02-061-2/+37
| | | | | | | | This API was intended to be an internal only, however like many things in OpenSSL, it is exposed externally and parts of the software ecosystem are now using it since there is no real alternative within the public API. ok doug@, tedu@ and reluctantly miod@
* Now that we have Camellia support in libcrypto, bring in the SHA256 flavour ofmiod2014-12-161-1/+133
| | | | the Camellia ciphersuites for TLS 1.2 introduced in RFC 5932. From OpenSSL HEAD.
* Provide functions for starting, finishing and writing SSL handshakejsing2014-12-141-1/+53
| | | | | | | | | | | | | | | messages. This will allow for removal of repeated/duplicated code. Additionally, DTLS was written by wholesale copying of the SSL/TLS code, with some DTLS specifics being added to the duplicated code. Since these SSL handshake message functions know how to handle both SSL/TLS and DTLS, upon conversion the duplicate versions will become identical (or close to), at which point the DTLS versions can be removed and the SSL/TLS versions used for both protocols. Partially based on similar changes in OpenSSL. ok miod@
* Remove trailing whitespace.jsing2014-12-141-10/+10
|
* unifdef OPENSSL_NO_NEXTPROTONEG, which is one of the last standing #ifndefjsing2014-12-141-3/+1
| | | | | | | mazes in libssl. NPN is being replaced by ALPN, however it is still going to be around for a while yet. ok miod@
* Remove support for GOST R 34.10-94 signature authentication, along withjsing2014-12-101-34/+1
| | | | | | | the two ciphersuites that use it. GOST94 public/private keys have been long obsoleted and libcrypto does not have support for them anyway. Discussed with Dmitry Eremin-Solenikov.
* Add support for ALPN.jsing2014-12-101-1/+6
| | | | | | Based on OpenSSL and BoringSSL. ok bcook@
* Update the GOST code in libssl, as contributed by Dmitry Eremin-Solenikov.miod2014-11-181-7/+40
| | | | | This causes a libssl major version bump as this affects the layout of some internal-but-unfortunately-made-visible structs.
* Add support for automatic DH ephemeral keys.jsing2014-10-311-13/+17
| | | | | | | This allows an SSL server to enable DHE ciphers with a single setting, which results in an DH key being generated based on the server key length. Partly based on OpenSSL.
* Remove support for ephemeral/temporary RSA private keys.jsing2014-10-311-88/+15
| | | | | | | | | The only use for these is via SSL_OP_EPHEMERAL_RSA (which is effectively a standards violation) and for RSA sign-only, should only be possible if you are using an export cipher and have an RSA private key that is more than 512 bits in size (however we no longer support export ciphers). ok bcook@ miod@
* Add support for automatic ephemeral EC keys.jsing2014-10-031-1/+9
| | | | | | | | | | This allows an SSL server to enable ECDHE ciphers with a single setting, which results in an EC key being generated using the first preference shared curve. Based on OpenSSL with inspiration from boringssl. ok miod@
* Clean up EC cipher handling in ssl3_choose_cipher().jsing2014-09-301-141/+16
| | | | | | | | | | | The existing code reaches around into various internals of EC, which it should not know anything about. Replace this with a set of functions that that can correctly extract the necessary details and handle the comparisions. Based on a commit to OpenSSL, with some inspiration from boringssl. ok miod@
* Remove SSL_kDHr, SSL_kDHd and SSL_aDH. No supported ciphersuites use them,jsing2014-09-071-4/+3
| | | | | | nor do we plan on supporting them. ok guenther@
* Replace the remaining uses of ssl3_put_cipher_by_char() with s2n and ajsing2014-08-241-16/+7
| | | | | | | ssl3_cipher_get_value() helper function, which returns the cipher suite value for the given cipher. ok miod@
* Remove non-standard GOST cipher suites (which are not compiled injsing2014-08-231-68/+1
| | | | | | currently). From Dmitry Eremin-Solenikov.
* Replace the remaining ssl3_get_cipher_by_char() calls with n2s() andjsing2014-08-231-23/+1
| | | | | | ssl3_get_cipher_by_id(). ok bcook@
* Provide a ssl3_get_cipher_by_id() function that allows ciphers to be lookedjsing2014-08-111-1/+14
| | | | | | | | up by their ID. For one, this avoids an ugly mess in ssl_sess.c, where the cipher value is manually written into a buffer, just so the cipher can be located using ssl3_get_cipher_by_char(). ok bcook@ miod@
* Tweak cipher list comments and add missing cipher value comments.jsing2014-08-101-5/+26
|
* Remove disabled (weakened export and non-ephemeral DH) cipher suites fromjsing2014-08-101-470/+5
| | | | | | | | the cipher list. This reduces code size, saves data segment space and prevents them from being turned back on at runtime by flipping a bit in memory. ok guenther@
* Oops, revert changes commited by mistake. The previous commit was supposedmiod2014-08-071-2/+4
| | | | to only apply to s23_srvr.c.
* When you expect a function to return a particular value, don't put a commentmiod2014-08-071-4/+2
| | | | | | | | | | | saying that you expect it to return that value and compare it against zero because it is supposedly faster, for this leads to bugs (especially given the high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this library). Instead, compare for the exact value it ought to return upon success. ok deraadt@
* The bell tolls for BUF_strdup - Start the migration to usingbeck2014-07-131-2/+2
| | | | | | intrinsics. This is the easy ones, a few left to check one at a time. ok miod@ deraadt@
* The correct name for EDH is DHE, likewise EECDH should be ECDHE.jsing2014-07-121-67/+67
| | | | | | Based on changes to OpenSSL trunk. ok beck@ miod@
* Remove the PSK code. We don't need to drag around thisbeck2014-07-111-71/+1
| | | | | baggage. ok miod@ jsing@
* decompress libssl. ok beck jsingtedu2014-07-101-5/+1
|
* tedu the SSL export cipher handling - since we do not have enabled exportjsing2014-07-091-18/+12
| | | | | | ciphers we no longer need the flags or code to support it. ok beck@ miod@
* remove unused, private version strings except SSL_version_strbcook2014-07-091-3/+1
| | | | | | Also remove unused des_ver.h, which exports some of these strings, but is not installed. ok miod@ tedu@
* Mark the weakened 40-bit export ciphers as invalid - no one in their rightjsing2014-07-081-9/+9
| | | | | | mind should be using them. ok deraadt@ miod@
* Remove SSL_FIPS.jsing2014-07-081-84/+84
| | | | ok deraadt@ miod@
* Nuke SSL_NOT_EXP since it does nothing.jsing2014-07-081-124/+124
| | | | ok deraadt@ miod@
* Specify the correct strength bits for 3DES cipher suites.jsing2014-06-211-15/+13
| | | | | | From OpenSSL. ok miod@
* Add ChaCha20-Poly1305 based ciphersuites.jsing2014-06-131-1/+52
| | | | | | Based on Adam Langley's chromium patches. Tested by and ok sthen@
* Switch the AES-GCM cipher suites to SSL_CIPHER_ALGORITHM2_AEAD.jsing2014-06-131-21/+68
|
* Remove support for the `opaque PRF input' extension, which draft has expiredmiod2014-06-131-55/+1
| | | | | | | | 7 years ago and never made it into an RFC. That code wasn't compiled in anyway unless one would define the actual on-the-wire extension id bytes; crank libssl major. With help and enlightenment from Brendan MacDonell.
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* Remove another NULL check before a BIO_free().jsing2014-06-071-4/+4
|
* ssl3_free_digest_list() has its own NULL check.jsing2014-06-071-5/+3
|
* BIO_free has an implicit NULL check, so do not bother checking for NULLjsing2014-06-071-2/+1
| | | | before calling it.
* ssl3_release_{read,write}_buffer() handle being called with NULL buffers,jsing2014-06-071-4/+3
| | | | so do not bother checking before calling.
* The DH_free, EC_KEY_free, EVP_PKEY_free and RSA_free functions all havejsing2014-06-071-27/+14
| | | | | implicit NULL checks, so there is no point ensuring that the pointer is non-NULL before calling them.
* More manual OPENSSL_NO_EC and OPENSSL_NO_TLSEXT cleanup.jsing2014-05-311-5/+1
|
* ECDH and ECDSA will not work overly well if there is no EC, so unifdefjsing2014-05-311-6/+0
| | | | | | OPENSSL_NO_EC. ok tedu@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-23 08:01:02 +0000