summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_sess.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Change SSLerror() back to taking two args, with the first one being an SSL *.beck2017-02-071-15/+15
| | | | | | | | | Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible
* Finish the fallout of the SSLerr->SSLerror cleanup to get rid of the uglybeck2017-01-261-23/+12
| | | | line wraps that resulted
* Send the error function codes to rot in the depths of hell where they belongbeck2017-01-261-15/+15
| | | | | | | We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@
* Add support for setting the supported EC curves viajsing2017-01-241-4/+4
| | | | | | | | | | | | | SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous SSL{_CTX}_set1_curves{_list} names. This also changes the default list of EC curves to be X25519, P-256 and P-384. If you want others (such a brainpool) you need to configure this yourself. Inspired by parts of BoringSSL and OpenSSL. ok beck@
* sk_SSL_CIPHER_free() checks for NULL so do not bother doing the same fromjsing2017-01-241-3/+2
| | | | the callers.
* ssl_sess_cert_free() checks for NULL, so do not bother doing it at thejsing2017-01-241-3/+6
| | | | call sites.
* There is no point in zeroing fields that exist within a struct that isjsing2017-01-241-3/+1
| | | | about to be explicit_bzero'd and freed.
* Split most of SSL_METHOD out into an internal variant, which is opaque.jsing2017-01-231-4/+3
| | | | Discussed with beck@
* Move a large part of ssl_st into internal, so we can see what squeals.beck2017-01-231-15/+15
| | | | ok jsing@
* Move ex_data, next and prev from SSL_SESSION to internal.jsing2017-01-231-24/+24
| | | | ok beck@
* Move most of the fields in SSL_CTX to internal - the ones that remain arejsing2017-01-231-28/+28
| | | | | | known to be in use. ok beck@
* move the callbacks from ssl_st to internalbeck2017-01-231-7/+7
| | | | ok jsing@
* Move callback function pointers and argument pointers from SSL_CTX tojsing2017-01-231-22/+22
| | | | | | internal. ok beck@
* Move not_resumable and sess_cert from SSL_SESSION to internal.jsing2017-01-231-5/+5
| | | | ok beck@
* Move the stats struct from SSL_CTX to internal.jsing2017-01-231-6/+6
| | | | ok beck@
* Move internal parts of ssl_session_st to internalbeck2017-01-221-9/+9
| | | | ok jsing@
* Convert publically visible structs to translucent structs.jsing2017-01-221-4/+12
| | | | | | | | | | | | | This change adds an internal opaque struct for each of the significant publically visible structs. The opaque struct is then allocated and attached to the publically visible struct when the appropriate *_new() function is called, then cleared and freed as necessary. This will allow for changes to be made to the internals of libssl, without requiring a major bump each time the publically visible structs are modified. ok beck@
* Expand LHASH_OF, IMPLEMENT_LHASH_DOALL_ARG_FN and LHASH_DOALL_ARG_FNjsing2016-11-021-5/+11
| | | | macros. Only change in generated assembly is due to line numbering.
* Wrap some >80 char lines.jsing2016-11-021-9/+9
|
* Sort and group functions.jsing2016-09-041-12/+11
|
* Expand IMPLEMENT_PEM macros.jsing2016-09-041-2/+29
| | | | No change in generated assembly.
* X509_free(3) is NULL-safe, so remove NULL checks before its calls.mmcc2016-03-111-3/+2
| | | | ok doug@
* Remove support for DTLS_BAD_VER. We do not support non-standard andjsing2015-09-101-2/+1
| | | | | | | incomplete implementations just so that we can interoperate with products from vendors who have not bothered to fix things in the last ~10 years. ok bcook@ miod@
* Correct spelling of OPENSSL_cleanse.jsing2015-09-101-4/+4
| | | | ok miod@
* Remove SSLv3 support from LibreSSL.doug2015-08-271-2/+1
| | | | | | | | | | This is the first wave of SSLv3 removal which removes the main SSLv3 functions. Future commits will remove the rest of the SSLv3 support. Discussed the plan at c2k15. Input from jsing@, beck@, miod@, bcook@, sthen@, naddy@, and deraadt@. ok jsing@, beck@
* Remove duplicate check in libssl.doug2015-07-211-3/+1
| | | | | | | If len == 0, it already set try_session_cache so there's no need to check len again. Fixes Coverity issue 21687. ok bcook@
* Remove trailing whitespace.jsing2014-12-141-8/+8
|
* Clean up more SSLv2 remnants.jsing2014-11-081-10/+9
|
* Use arc4random_buf() instead of RAND_bytes() or RAND_pseudo_bytes().jsing2014-10-181-4/+2
| | | | | | | | | | | | | | | arc4random provides high quality pseudo-random numbers, hence there is no need to differentiate between "strong" and "pseudo". Furthermore, the arc4random_buf() function is guaranteed to succeed, which avoids the need to check for and handle failure, simplifying the code. It is worth noting that a number of the replaced RAND_bytes() and RAND_pseudo_bytes() calls were missing return value checks and these functions can fail for a number of reasons (at least in OpenSSL - thankfully they were converted to wrappers around arc4random_buf() some time ago in LibreSSL). ok beck@ deraadt@ miod@
* Refactor and simplify the ECC extension handling. The existing codejsing2014-09-221-21/+1
| | | | | | | | | effectively built two "static" data structures - instead of doing this, just use static data structures to start with. From OpenSSL (part of a larger commit). ok miod@
* Provide a ssl3_get_cipher_by_id() function that allows ciphers to be lookedjsing2014-08-111-13/+2
| | | | | | | | up by their ID. For one, this avoids an ugly mess in ssl_sess.c, where the cipher value is manually written into a buffer, just so the cipher can be located using ssl3_get_cipher_by_char(). ok bcook@ miod@
* Since we no longer need to support SSLv2-style cipher lists, startjsing2014-08-101-3/+3
| | | | | | | | | | unravelling the maze of function pointers and callbacks by directly calling ssl3_{get,put}_cipher_by_char() and removing the ssl_{get,put}_cipher_by_char macros. Prompted by similar changes in boringssl. ok guenther.
* The bell tolls for BUF_strdup - Start the migration to usingbeck2014-07-131-2/+2
| | | | | | intrinsics. This is the easy ones, a few left to check one at a time. ok miod@ deraadt@
* Apply a large dose of KNF.jsing2014-07-121-126/+202
|
* Remove the PSK code. We don't need to drag around thisbeck2014-07-111-9/+1
| | | | | baggage. ok miod@ jsing@
* decompress libssl. ok beck jsingtedu2014-07-101-3/+2
|
* always compare memcmp against 0, for clarity.tedu2014-06-211-2/+2
|
* convert CRYPTO_memcmp to timingsafe_memcmp based on current policy favoringtedu2014-06-191-2/+2
| | | | | | libc interfaces over libcrypto interfaces. for now we also prefer timingsafe_memcmp over timingsafe_bcmp, even when the latter is acceptable. ok beck deraadt matthew miod
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* without overthinking it, replace a few memcmp calls with CRYPTO_memcmptedu2014-06-041-1/+1
| | | | where it is feasible to do so. better safe than sorry.
* ECDH and ECDSA will not work overly well if there is no EC, so unifdefjsing2014-05-311-6/+0
| | | | | | OPENSSL_NO_EC. ok tedu@
* TLS would not be entirely functional without extensions, so unifdefjsing2014-05-311-16/+0
| | | | | | OPENSSL_NO_TLSEXT. ok tedu@
* There is no point in checking if a pointer is non-NULL before calling free,jsing2014-05-281-21/+9
| | | | | | | | since free already does this for us. Also remove some pointless NULL assignments, where the result from malloc(3) is immediately assigned to the same variable. ok miod@
* Remove SRP and Kerberos support from libssl. These are complex protocolstedu2014-05-051-16/+0
| | | | | all on their own and we can't effectively maintain them without using them, which we don't. If the need arises, the code can be resurrected.
* whitespacetedu2014-04-231-2/+2
|
* more malloc/realloc/calloc cleanups; ok beck kettenisderaadt2014-04-211-3/+2
|
* Chop off more SSLv2 tentacles and start fixing and noting y2038 issues.guenther2014-04-201-4/+6
| | | | | | | APIs that pass times as longs will have to change at some point... Bump major on both libcrypto and libssl. ok tedu@
* More KNF and style consistency tweaksguenther2014-04-191-12/+12
|
* kill REF_PRINT/REF_CHECK debugging framework noone would usederaadt2014-04-171-9/+0
| | | | ok miod
* Change library to use intrinsic memory allocation functions instead ofbeck2014-04-171-16/+16
| | | | | | | | OPENSSL_foo wrappers. This changes: OPENSSL_malloc->malloc OPENSSL_free->free OPENSSL_relloc->realloc OPENSSL_freeFunc->free
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-08 18:14:34 +0000