| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Fix conditionals for DH controls. | jsing | 2017-08-09 | 1 | -3/+3 | |
| | | ||||||
| * | add missing and correct misspelled names, most in NAME sections; | schwarze | 2017-08-01 | 2 | -6/+8 | |
| | | | | | | found with regress/usr.bin/mandoc/db/dbm_dump; OK jmc@ | |||||
| * | as noted by Hanno Boeck, using the *check_private_key functions is | benno | 2017-07-25 | 1 | -6/+22 | |
| | | | | | | | tricky, especially since the manpage is full of lies. Try to make readers think twice before using them. With oks and help from schwarze@, tedu@, sthen@, jmc@ | |||||
| * | Rewrite and move the last remnants of the ServerHello SNI handling into | jsing | 2017-07-24 | 2 | -29/+25 | |
| | | | | | | | | | tlsext_sni_serverhello_parse(). This also adds a check to ensure that if we have an existing session, the name matches what we specified via SNI. ok doug@ | |||||
| * | Rewrite the TLS Renegotiation Indication extension handling using CBB/CBS | jsing | 2017-07-24 | 6 | -346/+161 | |
| | | | | | | | | | and the new extension framework. Feedback from doug@ ok inoguchi@ | |||||
| * | Hook the TLS extension parsing framework into the serverhello parsing. | jsing | 2017-07-23 | 1 | -1/+6 | |
| | | | | | Missed in the original commit. | |||||
| * | Check the return value of CBB_init_fixed(), since it can fail. | jsing | 2017-07-19 | 1 | -3/+5 | |
| | | ||||||
| * | Start rewriting TLS extension handling. | jsing | 2017-07-16 | 4 | -141/+328 | |
| | | | | | | | | | | | | | | | | | Introduce a TLS extension handling framework that has per-extension type functions to determine if an extension is needed, to build the extension data and parse the extension data. This is somewhat analogous to BoringSSL, however these build and parse functions are intentionally symetrical. The framework is hooked into the existing TLS handling code in such a way that we can gradual convert the extension handling code. Convert the TLS Server Name Indication extension to the new framework, while rewriting it to use CBB/CBS and be more strict in the process. Discussed with beck@ ok inoguchi@ | |||||
| * | Remove unused variable. | jsing | 2017-07-15 | 1 | -3/+3 | |
| | | | | | Reported by <dravion at ht-foss dot net> | |||||
| * | nits about trailing punctuation found with mandoc -Tlint | schwarze | 2017-07-05 | 1 | -4/+4 | |
| | | ||||||
| * | fix cross references to self; found with mandoc -Tlint | schwarze | 2017-07-05 | 2 | -6/+6 | |
| | | ||||||
| * | fix broken markup of callback arguments; found with mandoc -Tlint | schwarze | 2017-06-10 | 2 | -11/+8 | |
| | | ||||||
| * | Drop cipher suites with DSS authentication - there is no good reason to | jsing | 2017-05-07 | 1 | -197/+1 | |
| | | | | | | | keep these around. ok beck@ | |||||
| * | Instead of starting a 'zero-sized' CBB at the size of the first addition | jsing | 2017-05-07 | 1 | -5/+8 | |
| | | | | | | | | | to the CBB, then doubling, start with an initial size of 64 bytes. Almost all uses will exceed this size and we avoid multiple small recallocarray() calls during the initial usage. ok beck@ | |||||
| * | Move state from ssl->internal to the handshake structure. | beck | 2017-05-07 | 15 | -256/+267 | |
| | | | | | | | | while we are at it, convert SSLerror to use a function internally, so that we may later allocate the handshake structure and check for it ok jsing@ | |||||
| * | Bring in an SSL_HANDSHAKE structure and commence the great shovelling | beck | 2017-05-06 | 11 | -113/+119 | |
| | | | | | ok jsing@, gcc@, regress@ | |||||
| * | Provide SSL{,_CTX}_set_{min,max}_proto_version() functions. | jsing | 2017-05-06 | 6 | -5/+115 | |
| | | | | | | | Rides minor bump. ok beck@ | |||||
| * | Bump minors for symbol addition in libcrypto | beck | 2017-05-06 | 1 | -1/+1 | |
| | | | | | ok jsing@ | |||||
| * | Add missing $OpenBSD$ tags. | jsing | 2017-05-06 | 4 | -2/+4 | |
| | | ||||||
| * | Only enable -Werror on libcrypto/libssl/libtls if we are building with | jsing | 2017-04-30 | 1 | -2/+3 | |
| | | | | | | | | gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@ | |||||
| * | Switch back to freezero() and explicitly initialise data_len to zero. The | jsing | 2017-04-30 | 1 | -6/+3 | |
| | | | | | | previous code was safe since data would always be NULL if data_len was uninitialised, however compilers cannot know this. | |||||
| * | Fix a bug caused by the return value being set early to signal successful | jsing | 2017-04-29 | 1 | -5/+5 | |
| | | | | | | | | | | | | | | | | DTLS cookie validation. This can mask a later failure and result in a positive return value being returned from ssl3_get_client_hello(), when it should return a negative value to propagate the error. Ironically this was introduced in OpenSSL 2e9802b7a7b with the commit message "Fix DTLS cookie management bugs". Fix based on OpenSSL. Issue reported by Nicolas Bouliane <nbouliane at jive dot com>. ok beck@ | |||||
| * | Revert previous - we still want to do this, but I forgot about the installer | beck | 2017-04-29 | 2 | -14/+6 | |
| | | | | | | and want to avoid the wrath of theo when he arrives home in a couple of hours :) | |||||
| * | We now require you to have a working libpthread | beck | 2017-04-29 | 1 | -1/+2 | |
| | | ||||||
| * | Make it safe to call SSL_library_init more than once. | beck | 2017-04-29 | 1 | -5/+12 | |
| | | | | | | | We are basically admitting that pthread is everywhere, and we will be using it for other things too. ok jsing@ | |||||
| * | backout previous, data_len is not always initialized | otto | 2017-04-16 | 1 | -2/+5 | |
| | | ||||||
| * | Use freezero(3) when cleaning up session tickets - not only does it require | jsing | 2017-04-14 | 1 | -6/+3 | |
| | | | | | | less code, but there is also a potential performance gain since they can be larger allocations. | |||||
| * | Use freezero(3) to clean up the X25519 keys - simpler, cleaner code. | jsing | 2017-04-14 | 1 | -6/+3 | |
| | | ||||||
| * | Use freezero(3) in the CBB clean up path, since this could hold sensitive | jsing | 2017-04-14 | 1 | -3/+2 | |
| | | | | | information (such as master keys). | |||||
| * | Switch i2d_SSL_SESSION() back to freezero(3) now that the size constraints | jsing | 2017-04-14 | 1 | -5/+2 | |
| | | | | | have been relaxed. | |||||
| * | Clean up server key exchange EC point handling. Encode the point directly | jsing | 2017-04-14 | 1 | -27/+15 | |
| | | | | | | | | | into the CBB memory, rather than mallocing and memcpying, which also makes makes the code more consistent with the client. Add a missing check for the first EC_POINT_point2oct() call. ok beck@ | |||||
| * | Revert ssl_asn1.c r1.50 - CBB and freezero(3) do not play nicely together. | jsing | 2017-04-11 | 1 | -2/+5 | |
| | | | | | | | Back this out while we investigate and implement a solution. Found the hard way by sthen@ | |||||
| * | Use freezero() for the internal opaque structures, instead of the current | jsing | 2017-04-10 | 3 | -18/+9 | |
| | | | | | explicit_bzero()/free(). Less code and potentially less overhead. | |||||
| * | Use freezero() for X25519 keys - same result with more readable code. | jsing | 2017-04-10 | 1 | -7/+3 | |
| | | ||||||
| * | freezero() the key block; simpler code and less of it. | jsing | 2017-04-10 | 1 | -7/+3 | |
| | | ||||||
| * | Use freezero() for i2d_SSL_SESSION() - one line of code instead of three. | jsing | 2017-04-10 | 1 | -5/+2 | |
| | | | | | | | In this case the memory allocated can also be significant, in which case freezero() will have less overhead than explicit_bzero() (munmap instead of touching all of the memory to write zeros). | |||||
| * | fix some .Xr errors that jmc@ found with mdoclint(1) | schwarze | 2017-04-10 | 3 | -12/+13 | |
| | | ||||||
| * | new manual page SSL_get_server_tmp_key(3) | schwarze | 2017-04-10 | 3 | -2/+88 | |
| | | | | | from Matt Caswell <matt@openssl.org>, OpenSSL commit 508fafd8 | |||||
| * | Additional SSL_SESSION documentation | schwarze | 2017-04-10 | 11 | -16/+349 | |
| | | | | | | from Matt Caswell <matt at openssl dot org>, OpenSSL commit b31db505. Improve crosslinking while here. | |||||
| * | for pure *_ctrl() wrapper macros, move the reference from ssl(3) | schwarze | 2017-04-10 | 14 | -49/+54 | |
| | | | | | to SSL_CTX_ctrl(3) to make ssl(3) slightly more palatable | |||||
| * | new manual page SSL_CTX_set_tlsext_servername_callback(3) for SNI; | schwarze | 2017-04-10 | 2 | -1/+126 | |
| | | | | | | from <Jon dot Spillett at oracle dot com> via OpenSSL commit 8c55c461 | |||||
| * | Convert various client key exchange functions to freezero(3). The memory | jsing | 2017-04-10 | 1 | -14/+5 | |
| | | | | | | contents needs to be made inaccessible - this is simpler and less error prone than the current "if not NULL, explicit_bzero(); free()" dance. | |||||
| * | pasto; from <Jon dot Spillett at oracle dot com> via OpenSSL commit 3aaa1bd0 | schwarze | 2017-04-10 | 1 | -3/+3 | |
| | | ||||||
| * | typo fix; from <Jon dot Spillett at oracle dot com> | schwarze | 2017-04-10 | 1 | -5/+5 | |
| | | | | | via OpenSSL commit 7bd27895 | |||||
| * | tweak previous; | jmc | 2017-03-29 | 1 | -3/+5 | |
| | | ||||||
| * | Fix typo in function name; | schwarze | 2017-03-28 | 1 | -4/+5 | |
| | | | | | | from Markus Triska <triska at metalevel dot at> via OpenSSL commit 1f164c6f. | |||||
| * | After i wrote SSL_renegotiate(3) from scratch, OpenSSL also | schwarze | 2017-03-28 | 1 | -12/+109 | |
| | | | | | | | | documented the function. Merge the more detailed descriptions and the additional documentation of SSL_renegotiate_abbreviated(3) and SSL_renegotiate_pending(3). From Matt Caswell, OpenSSL commit 39820637. | |||||
| * | Update RFC reference for TLSEXT_TYPE_padding. | jsing | 2017-03-25 | 1 | -5/+2 | |
| | | ||||||
| * | Check tls1_PRF() return value in tls1_generate_master_secret(). | jsing | 2017-03-25 | 1 | -4/+4 | |
| | | ||||||
| * | More cleanup for tls1_PRF()/tls1_P_hash() - change the argument order of | jsing | 2017-03-25 | 1 | -46/+50 | |
| | | | | | | | | tls1_PRF() so that it matches tls1_P_hash(), use more explicit argument names and change lengths to size_t. ok inoguchi@ | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |