summaryrefslogtreecommitdiff
path: root/src/lib/libssl/ssl_transcript.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-10-13ssltest.c does not need param.htb1-1/+0
From Jonas Termansen
2021-10-13Remove __dead from usage() to reduce the diff needed to build LibreSSLtb1-3/+3
on sortix. Prompted by a diff by Jonas Termansen
2021-10-13Provide realpath(1)kn1-2/+3
A tiny realpath(3) wrapper to make a porter's life easier. Feedback kettenis deraadt cheloha sthen OK cheloha martijn deraadt
2021-10-11does not need arpa/nameser.hderaadt1-2/+1
2021-10-06X509_STORE_CTX_init() allows the store to be NULL on init. Add checksclaudio1-1/+11
for a NULL ctx->ctx in the lookup functions using X509_STORE_CTX. This affects X509_STORE_get1_certs(), X509_STORE_get1_crls(), X509_STORE_CTX_get1_issuer() and X509_STORE_get_by_subject(). With this X509_verify_cert() no longer crashes with a NULL store. With and OK tb@
2021-10-02Use SSL_CTX_get0_param() rather than reaching into the SSL_CTX.jsing1-2/+2
2021-09-30Mark another test as failing with the legacy verifier.jsing2-2/+4
This test now fails with the legacy verifier, due to X509_V_FLAG_TRUSTED_FIRST being enabled by default.
2021-09-30Enable X509_V_FLAG_TRUSTED_FIRST by default in the legacy verifier.jsing1-1/+2
In order to work around the expired DST Root CA X3 certficiate, enable X509_V_FLAG_TRUSTED_FIRST in the legacy verifier. This means that the default chain provided by Let's Encrypt will stop at the ISRG Root X1 intermediate, rather than following the DST Root CA X3 intermediate. Note that the new verifier does not suffer from this issue, so only a small number of things will hit this code path. ok millert@ robert@ tb@
2021-09-30delete expired DST Root CA X3 to work around bugs various librariesderaadt1-44/+1
ok sthen, beck, jsing, tb, etc etc
2021-09-28Remove recent changes used to unblock the signal undergoing testing, I solved itanton2-30/+2
by changing my regress environment instead. This reduces the delta to the NetBSD upstream.
2021-09-27Mark "failures" volatile to avoid a problem with sigsetjmp/siglongjmp.millert2-4/+4
This makes the test pass on sparc64 where the compiler may otherwise store the variable in the strlcpy/strlcat function's delay slot. OK kettenis@
2021-09-27These tests pass in a few seconds. Remove REGRESS_SLOW_TARGETS.bluhm1-3/+1
2021-09-27Make t_gettimeofday pass on sparc64.mbuhl1-1/+3
OK bluhm@
2021-09-24Simplify runAesCmacTest() by using EVP_DigestSign().tb1-16/+3
2021-09-23Avoid a potential overread in x509_constraints_parse_mailbox()jsing1-5/+9
The length checks need to be >= rather than > in order to ensure the string remains NUL terminated. While here consistently check wi before using it so we have the same idiom throughout this function. Issue reported by GoldBinocle on GitHub. ok deraadt@ tb@
2021-09-23Remove an unused variable and a pointless label.tb1-7/+1
ok inoguchi
2021-09-20Fix appstest.sh for testing with OpenSSL 3.0inoguchi1-2/+5
- Fix 'Server Temp Key' check to work with both words "P-384" and "secp384r1". - Test TLSv1 and TLSv1.1 only if OpenSSL version is 1.x.
2021-09-19Switch two calls from memset() to explicit_bzero()tb1-3/+3
This matches the documented behavior more obviously and ensures that these aren't optimized away, although this is unlikely. Discussed with deraadt and otto
2021-09-19At least t_fork and t_vfork tests need coredumps enabled to succeed.claudio1-1/+2
Add ulimit -c unlimited before running the tests like it is done in other places in regress. OK bluhm@
2021-09-16Implement flushing for TLSv1.3 handshakes.jsing5-7/+69
When we finish sending a flight of records, flush the record layer output. This effectively means calling BIO_flush() on the wbio. Some things (such as apache2) have custom BIOs that perform buffering and do not actually send on BIO_write(). Without BIO_flush() the server thinks it has sent data and starts receiving records, however the client never sends records since it never received those that the server should have sent. Joint work with tb@ ok tb@
2021-09-15bump to LibreSSL 3.4.1tb1-3/+3
2021-09-14Avoid typedef redefinitionlibressl-v3.4.0inoguchi1-3/+1
"typedef struct ssl_st SSL;" is defined in ossl_typ.h. This reverts part of r1.204. ok tb@
2021-09-14Add missing void to definition of http_init().tb1-2/+2
ok deraadt florian
2021-09-14zap trailing white spacetb1-2/+2
2021-09-14Call the info cb on connect/accept exit in TLSv1.3tb2-4/+16
The p5-Net-SSLeay test expects the info callback to be called on connect exit. This is the behavior in the legacy stack but wasn't implemented in the TLSv1.3 stack. With this commit, p5-Net-SSLeay tests are happy again after the bump. ok bluhm inoguchi jsing
2021-09-14provide a small manual page for the SSL_set_psk_use_session_callback(3)schwarze2-1/+88
stub, written from scratch; OK tb@ on SSL_set_psk_use_session_callback.3
2021-09-14Merge the stub SSL_SESSION_is_resumable(3) manual page from theschwarze3-3/+86
OpenSSL 1.1.1 branch, which is still under a free license. A few tweaks to wording and structure by me. OK tb@ on SSL_SESSION_is_resumable.3
2021-09-14As suggested by tb@, merge the description of OPENSSL_EC_NAMED_CURVEschwarze1-9/+15
and OPENSSL_EC_EXPLICIT_CURVE from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000 after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE in ec/ec_lib.c rev. 1.41, which is the same default that OpenSSL uses since 1.1.0. While merging, drop the description of the pre-1.1.0 behaviour. It seems irrelevant to me because tb@ found no application in Debian codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default that was probably never relied upon by anyone does not need to be documented.
2021-09-13In X509_check_issued() do the same dance around x509v3_cache_extensions()claudio1-3/+11
as in all other palces. Check the EXFLAG_SET flag first and if not set grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions(). OK tb@ beck@
2021-09-12Default to using named curve parameter encodingtb2-4/+5
The pre-OpenSSL 1.1.0 default was to use explicit curve parameter encoding. Most applications want to use named curve parameter encoding and have to opt into this explicitly. Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into the old default. According to Debian's codesearch, no application currently does this, which indicates that we currently have a bad default. In the future it is more likely that applications expect the new default, so we follow OpenSSL to avoid problems. Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing. ok beck inoguchi jsing
2021-09-11merge the description of SSL_get_tlsext_status_type(3)schwarze1-3/+35
from the OpenSSL 1.1.1 branch, which is still under a free license
2021-09-11Merge documentation of EC_GROUP_order_bits(3) from the OpenSSL 1.1.1schwarze1-26/+70
branch, which is still under a free license. While here, also merge a few other improvements, mostly regarding EC_GROUP_get_order(3) and EC_GROUP_get_cofactor(3); in particular, some statements below RETURN VALUES were outright wrong. This patch includes a few minor tweaks and an addition to HISTORY by me. Feedback and OK tb@.
2021-09-11Add BGPSec Router (RFC 8209) Key Purpose OIDjob2-0/+2
OK tb@
2021-09-11Merge documentation for BN_bn2binpad(3), BN_bn2lebinpad(3),schwarze1-13/+77
and BN_lebin2bn(3) from the OpenSSL 1.1.1 branch, which is still under a free license. While here, tweak a number of details for clarity. OK tb@
2021-09-10Calling OpenSSL_add_all_digests() is no longer needed since the librarymillert1-7/+2
automatically initializes itself. OK tb@
2021-09-10crank major for libcrypto as welltb1-2/+2
'may as well' deraadt
2021-09-10major bump (same type of crank as libssl)tb1-1/+1
2021-09-10bump major after symbol addition and struct removal, struct visibilitytb1-1/+1
changes
2021-09-10Update Symbols.list after API additionstb1-0/+18
2021-09-10Bump minor after symbol additiontb1-1/+1
2021-09-10Add BN_bn2{,le}binpad(), BN_lebin2bn(), EC_GROUP_order_bits to Symbols.listtb1-0/+4
ok beck inoguchi jsing
2021-09-10Move SSL_set0_rbio() outside of LIBRESSL_HAS_TLS1_3tb1-3/+1
ok inoguchi jsing
2021-09-10Expose SSL_get_tlext_status_type() in tls1.htb1-3/+1
ok beck jsing
2021-09-10Expose SSL_R_NO_APPLICATION_PROTOCOL in ssl.htb1-3/+1
ok beck jsing
2021-09-10Expose SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE in ssl.htb1-3/+1
ok beck jsing
2021-09-10Expose SSL_CTX_get0_privatekey() in ssl.htb1-3/+1
ok beck
2021-09-10Remove TLS1_get_{,client_}version()tb1-9/+1
ok jsing
2021-09-10Remove SSL3_RECORD and SSL3_BUFFERtb1-25/+1
with/ok jsing
2021-09-10Remove TLS1_RT_HEARTBEATtb1-2/+1
ok jsing
2021-09-10Make SSL opaquetb1-2/+4
with/ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-27 20:45:50 +0000