summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Actually parse the ALPN extension in a client hello, even if no ALPNjsing2017-08-291-4/+4
| | | | | | | | callback has been installed. This ensures that the ALPN extension is valid and avoids leaving unprocessed extension data, which leads to a decode error. Found the hard way by jsg@
* ECDHE-RSA-DES-CBC3-SHA should not be marked HIGH.jsing2017-08-281-2/+2
| | | | Spotted by Andreas Bartelt <obsd at bartula dot de>
* Bump lib{crypto,ssl,tls} majors due to symbol removals.jsing2017-08-281-2/+2
|
* Completely remove NPN remnants.jsing2017-08-287-107/+9
| | | | Based on a diff from doug@, similar diff from inoguchi@
* Remove the original (pre-IETF) chacha20-poly1305 cipher suites.jsing2017-08-284-73/+5
| | | | | | | | | | Support for the IETF standardised chacha20-poly1305 cipher suites was added 16 months ago, which means they exist in both of the currently supported OpenBSD releases. Also prompted by Andreas Bartelt <obsd at bartula dot de>. ok beck@ doug@
* Rewrite SRTP extension using CBB/CBS and the new extension framework.doug2017-08-275-274/+250
| | | | input + ok beck@, jsing@
* Rewrite ALPN extension using CBB/CBS and the new extension framework.doug2017-08-264-143/+159
| | | | | ok bcook@ beck@ input + ok jsing@
* Work around bug in F5's handling of the supported elliptic curves extension.doug2017-08-231-2/+16
| | | | | | | | | | RFC 4492 only defines elliptic_curves for ClientHello. However, F5 is sending it in ServerHello. We need to skip over it since our TLS extension parsing code is now more strict. Thanks to Armin Wolfermann and WJ Liu for reporting the issue. input + ok jsing@
* import SSL_export_keying_material(3) from OpenSSLschwarze2017-08-213-3/+132
|
* merge the applicable parts of SSL_set_tlsext_host_name(3) documentation;schwarze2017-08-211-4/+28
| | | | | from Paul Yang <yang dot yang at baishancloud dot com> via OpenSSL commit 190b9a03 Jun 28 15:46:13 2017 +0800
* Selectively merge OpenSSL commit e091367d May 5 11:56:45 2017 +0100schwarze2017-08-211-16/+15
| | | | | | | from Matt Caswell <matt at openssl dot org>. In particular, stop talking about SSL 2.0 and SSL 3.0, but do not start talking about TLS 1.3 just yet.
* Mention three functions related to protocol selection by the clientschwarze2017-08-211-3/+48
| | | | | that are deprecated no-ops in LibreSSL, but that OpenSSL explicitly documented on April 19, 2017, without deprecating them.
* Delete non-existent function SSL_flush_sessions();schwarze2017-08-211-12/+4
| | | | | from Rich Salz <rsalz at openssl dot org> via OpenSSL commit 1722496f Jun 8 15:18:38 2017 -0400.
* Delete non-existent functions SSL_add_session() and SSL_remove_session() andschwarze2017-08-211-18/+6
| | | | | | | | | clarify that SSL_CTX_remove_session(3) marks the session as non-resumable. From Rich Salz <rsalz at openssl dot org> via OpenSSL commit 1722496f Jun 8 15:18:38 2017 -0400 and from Matt Caswell <matt at openssl dot org> via OpenSSL commit b8964668 Apr 26 15:16:18 2017 +0100.
* New manual page X509_check_private_key(3), using informationschwarze2017-08-201-3/+4
| | | | | | | | from the OpenSSL manual and from code inspection. Use my own Copyright and license because no Copyright-worthy amount of text from OpenSSL remains. And, no, these functions do *NOT* check private keys, not at all.
* remove a duplicate BIO_do_accept() call from an example;schwarze2017-08-201-12/+6
| | | | | from Beat Bolli <dev at drbeat dot li> via OpenSSL commit 7a67a3ba Jan 18 23:49:43 2017 +0100
* fix .Xr ordering, found with mandoc -Tlintschwarze2017-08-192-6/+6
|
* Import SSL_CTX_set_min_proto_version(3) from OpenSSL, suggested by jsing@.schwarze2017-08-195-7/+134
| | | | | | | | | While importing: * Fix the prototypes, they all contained wrong datatypes. * Delete SSL3_VERSION which is no longer supported. * Delete TLS1_3_VERSION and DTLS1_2_VERSION, not yet supported. * Delete the lie that these would be macros. * Improve SEE ALSO and HISTORY sections.
* fix a typo and mention OpenBSD in HISTORY;schwarze2017-08-191-3/+5
| | | | both pointed out by jsing@
* match function implementation with declaration, ok beck@, doug@bcook2017-08-131-2/+2
|
* Switch to -Werror with clang for libressl.doug2017-08-131-2/+2
| | | | | Discussed with beck@ and jsing@ ok beck@
* Make SSL{,_CTX}_set_alpn_protos() do atomic updates and handle NULL.doug2017-08-131-10/+38
| | | | | | | | | | | Previously, the code would accept NULL and 0 length and try to malloc/memcpy it. On OpenBSD, malloc(0) does not return NULL. It could also fail in malloc and leave the old length. Also, add a note that this public API has backwards semantics of what you would expect where 0 is success and 1 is failure. input + ok jsing@ beck@
* Remove support for the TLS padding extension.jsing2017-08-132-39/+4
| | | | | | | | This was added as a workaround for broken F5 TLS termination, which then created issues talking to broken IronPorts. The size of the padding is hardcoded so it cannot be used in any generic sense. ok bcook@ beck@ doug@
* Nuke SSL_OP_CRYPTOPRO_TLSEXT_BUG.jsing2017-08-132-27/+4
| | | | | | | This was a workaround for a server that needed to talk GOST to old/broken CryptoPro clients. This has no impact on TLS clients that are using GOST. ok bcook@ beck@ doug@
* Rewrite the TLS status request extension to use the new TLS extension framework.beck2017-08-123-177/+179
| | | | ok jsing@
* Convert TLS signature algorithms extension handling to the new framework.jsing2017-08-126-63/+99
| | | | ok beck@ doug@
* Rewrite session ticket TLS extension handling using CBB/CBS and the newdoug2017-08-123-65/+145
| | | | | | extension framework. ok jsing@ beck@
* Remove NPN support.jsing2017-08-127-377/+28
| | | | | | | | | | | | | NPN was never standardised and the last draft expired in October 2012. ALPN was standardised in July 2014 and has been supported in LibreSSL since December 2014. NPN has also been removed from Chromium in May 2016. TLS clients and servers that try to use/enable NPN will fail gracefully and fallback to the default protocol, since it will essentially appear that the otherside does not support NPN. At some point in the future we will actually remove the NPN related symbols entirely. ok bcook@ beck@ doug@
* Import the SSL_CTX_set1_groups(3) manual page from OpenSSL, deletingschwarze2017-08-125-6/+173
| | | | | | the read accessors we don't have and fixing the prototypes - the data type of each and every argument differs in the OpenSSL manuals. Reference the new page from SSL_set_tmp_ecdh(3) as suggested by jsing@.
* New manual page SSL_set_tmp_ecdh(3) written from scratch.schwarze2017-08-124-7/+112
| | | | Feedback and OK jsing@.
* Remove lots of outdated information found by jsing@.schwarze2017-08-121-192/+14
| | | | OK jsing.
* Remove support for DSS/DSA, since we removed the cipher suites a whilejsing2017-08-129-85/+16
| | | | | | back. ok guenther@
* Clear the child pointer in CBB_cleanup(), so that we have fewer pointersjsing2017-08-121-1/+2
| | | | | | hanging around to potentially invalid address space. Discussed with beck@ and doug@
* remove bogus ".POD" from .Dt name; noticed by jsing@schwarze2017-08-111-3/+3
|
* I don't think eay will ever fix this...jsing2017-08-111-2/+2
|
* style(9) in ssl_set_cert_masks().jsing2017-08-111-7/+7
|
* Rewrite EllipticCurves TLS extension handling using CBB/CBS and the newdoug2017-08-114-76/+135
| | | | | | extension framework. input + ok jsing@
* Convert ssl3_send_certificate_request() to CBB.jsing2017-08-113-63/+73
| | | | ok beck@ doug@
* Add doug@'s copyright since he just added code to these two files.jsing2017-08-112-2/+4
|
* Rewrite the ECPointFormats TLS extension handling using CBB/CBS and thedoug2017-08-114-147/+125
| | | | | | new extension framework. input + ok jsing@
* Clean up the EC key/curve configuration handling.jsing2017-08-107-120/+54
| | | | | | | | | | | | | | | | | | | | | | Over the years OpenSSL grew multiple ways of being able to specify EC keys (and/or curves) for use with ECDH and ECDHE key exchange. You could specify a static EC key (SSL{_CTX,}_set_tmp_ecdh()), use that as a curve and generate ephemeral keys (SSL_OP_SINGLE_ECDH_USE), provide the EC key via a callback that was provided with insufficient information (SSL{_CTX,}_set_tmp_ecdh_cb()) or enable automatic selection and generation of EC keys via SSL{_CTX,}_set_ecdh_auto(). This complexity leads to problems (like ECDHE not being enabled) and potential weird configuration (like being able to do ECDHE without the ephemeral part...). We no longer support ECDH and ECDHE can be disabled by removing ECDHE ciphers from the cipher list. As such, permanently enable automatic EC curve selection and generation, effectively disabling all of the configuration knobs. The only exception is the SSL{_CTX,}_set_tmp_ecdh() functions, which retain part of their previous behaviour by configuring the curve of the given EC key as the only curve being enabled. Everything else becomes a no-op. ok beck@ doug@
* Pull out the code that identifies if we have an ECC cipher in the cipherjsing2017-08-093-34/+52
| | | | | | | list or if we are negotiating an ECC cipher in the handshake. This dedups some of the existing code and will make the EC extension rewrites easier. ok doug@
* Consistently return from each SSL/SSL_CTX control case, rather thanjsing2017-08-091-33/+27
| | | | breaking from some and returning from others.
* Split out the remaining SSL_CTX controls into individual functions.jsing2017-08-091-40/+88
|
* Start splitting out SSL_CTX controls into individual functions, so thatjsing2017-08-091-71/+92
| | | | they can eventually be exposed as direct functions/symbols.
* Be consistent and return from each SSL control case, rather than breakingjsing2017-08-091-18/+10
| | | | from some.
* Split out the remaining SSL controls into individual functions.jsing2017-08-091-46/+93
|
* Split more controls into individual functions.jsing2017-08-091-64/+91
|
* Start splitting out controls into individual functions, so that they canjsing2017-08-091-29/+63
| | | | eventually be exposed as direct functions/symbols.
* Remove unnecessary curly braces and unindent. Also add a few blank linesjsing2017-08-091-11/+13
| | | | for readability.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 15:30:11 +0000