| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Split out the DHE and ECDHE code paths from | jsing | 2016-11-06 | 1 | -203/+221 | |
| | | | | | | | ssl3_send_server_key_exchange(). ok beck@ bcook@ | |||||
| * | Adjust cipher suite strengths - move MD5 to LOW, RC4 to LOW and 3DES to | jsing | 2016-11-06 | 1 | -13/+13 | |
| | | | | | | | MEDIUM. ok beck@ bcook@ | |||||
| * | Remove the single IDEA cipher suite. There is no good reason to support | jsing | 2016-11-06 | 3 | -29/+3 | |
| | | | | | | | this. ok beck@ bcook@ | |||||
| * | unifdef -m -UOPENSSL_NO_CHACHA -UOPENSSL_NO_POLY1305 | jsing | 2016-11-06 | 2 | -6/+2 | |
| | | | | | ok beck@ | |||||
| * | remove unused variable | bcook | 2016-11-06 | 1 | -6/+3 | |
| | | ||||||
| * | One of the error paths would attempt to access not-yet-initialized locals. | miod | 2016-11-05 | 1 | -2/+2 | |
| | | | | | | | Simply return since there is nothing more to do. Spotted by coverity. ok jsing@ beck@ | |||||
| * | Do a partial CBB conversion of ssl3_send_server_key_exchange(), which will | jsing | 2016-11-05 | 1 | -52/+67 | |
| | | | | | | | make it easier to do further clean up. ok beck@ miod@ | |||||
| * | move manual pages from doc/ to man/ for consistency with other | schwarze | 2016-11-05 | 85 | -169/+169 | |
| | | | | | | libraries, in particular considering that there are unrelated files in doc/; requested by jsing@ and beck@ | |||||
| * | bump minors for symbol addition for ocsp and x25519 symbol additions | beck | 2016-11-05 | 1 | -1/+1 | |
| | | ||||||
| * | after getting rid of the pod files, clean up the Makefiles; ok bcook@ | schwarze | 2016-11-05 | 2 | -28/+13 | |
| | | ||||||
| * | Convert ssl3_get_server_kex_ecdhe() to CBS, simplifying tls1_check_curve() | jsing | 2016-11-05 | 3 | -62/+41 | |
| | | | | | | | | in the process. This also fixes a long standing bug where tls1_ec_curve_id2nid() is called with only one byte of the curve ID. ok beck@ miod@ | |||||
| * | Remove generated Symbols.map on make clean. | jsing | 2016-11-05 | 1 | -2/+2 | |
| | | | | | ok guenther@ | |||||
| * | Rename ssl3_get_key_exchange() to ssl3_get_server_key_exchange(), since | jsing | 2016-11-04 | 3 | -7/+7 | |
| | | | | | | | that's what it really is. ok miod@ | |||||
| * | Tidy up the usage of peer_ecdh_tmp, following the fixed ECDH removal. | jsing | 2016-11-04 | 1 | -13/+5 | |
| | | | | | ok beck@ | |||||
| * | Mark a couple local functions as static | guenther | 2016-11-04 | 2 | -4/+4 | |
| | | | | | ok jsing@ beck@ | |||||
| * | The *_method_data structures can be static | guenther | 2016-11-04 | 6 | -21/+21 | |
| | | | | | ok jsing@ | |||||
| * | Add an explict list of exported symbols with just the functions | guenther | 2016-11-04 | 5 | -11/+289 | |
| | | | | | | | | declared in the public headers, and use __{BEGIN,END}_HIDDEN_DECLS in the internal headers to optimize internal functions ok jsing@ | |||||
| * | make public ASN1_time_parse and ASN1_time_tm_cmp to replace former hidden | beck | 2016-11-04 | 1 | -2/+2 | |
| | | | | | | | functions.. document with a man page. bump majors on libtls, libssl, libcrypto ok jsing@ guenther@ | |||||
| * | Make do_dtls1_write() static to d1_pkt.c and delete declarations for | guenther | 2016-11-04 | 2 | -8/+6 | |
| | | | | | | | three functions that were removed a while ago ok jsing@ | |||||
| * | Fix some linewrapping glitches | guenther | 2016-11-04 | 1 | -7/+5 | |
| | | | | | ok jsing@ | |||||
| * | Completely rewrite the session handling ASN.1 code using CBB and CBS. This | jsing | 2016-11-04 | 1 | -616/+329 | |
| | | | | | | | | addresses two 2038 related issues and also adds support for allocation in the i2d function, which will allow for simplification in the callers. ok beck@ miod@ | |||||
| * | Convert ssl3_get_server_kex_dhe() to CBS. | jsing | 2016-11-04 | 1 | -42/+19 | |
| | | | | | ok beck@ | |||||
| * | In ssl3_read_bytes(), do not process more than three consecutive TLS | jsing | 2016-11-03 | 1 | -4/+24 | |
| | | | | | | | | | records, otherwise a peer can potentially cause us to loop indefinately. Return with an SSL_ERROR_WANT_READ instead, so that the caller can choose when they want to handle further processing for this connection. ok beck@ miod@ | |||||
| * | Split ssl3_get_key_exchange() into separate functions for DHE/ECDHE. | jsing | 2016-11-03 | 1 | -205/+256 | |
| | | | | | ok beck@ (who was struggling to keep lunch down while reviewing the diff) | |||||
| * | Clean up the TLS handshake digest handling - this refactors some of the | jsing | 2016-11-03 | 2 | -30/+43 | |
| | | | | | | | | | | | | | | | | | | | | code for improved readability, however it also address two issues. The first of these is a hard-to-hit double free that will occur if EVP_DigestInit_ex() fails. To avoid this and to be more robust, ensure that tls1_digest_cached_records() either completes successfully and sets up all of the necessary digests, or it cleans up and frees everything that was allocated. The second issue is that EVP_DigestUpdate() can fail - detect and handle this in tls1_finish_mac() and change the return type to an int so that a failure can be propagated to the caller (the callers still need to be fixed to handle this, in a later diff). The double-free was reported by Matthew Dillon. ok beck@ doug@ miod@ | |||||
| * | Expand LHASH_OF, IMPLEMENT_LHASH_DOALL_ARG_FN and LHASH_DOALL_ARG_FN | jsing | 2016-11-02 | 2 | -7/+13 | |
| | | | | | macros. Only change in generated assembly is due to line numbering. | |||||
| * | Expand another LHASH_OF macro. | jsing | 2016-11-02 | 1 | -2/+2 | |
| | | ||||||
| * | Expand DECLARE_LHASH_OF and LHASH_OF macros. | jsing | 2016-11-02 | 1 | -3/+5 | |
| | | ||||||
| * | Expand DECLARE_PEM_rw macro. | jsing | 2016-11-02 | 1 | -2/+7 | |
| | | ||||||
| * | Expand IMPLEMENT_LHASH_COMP_FN/IMPLEMENT_LHASH_HASH_FN macros - the only | jsing | 2016-11-02 | 1 | -5/+17 | |
| | | | | | change to generated assembly results from a difference in line numbers. | |||||
| * | Wrap some >80 char lines. | jsing | 2016-11-02 | 1 | -9/+9 | |
| | | ||||||
| * | Remove support for fixed ECDH cipher suites - these is not widely supported | jsing | 2016-10-19 | 7 | -466/+42 | |
| | | | | | | | | | | and more importantly they do not provide PFS (if you want to use ECDH, use ECDHE instead). With input from guenther@. ok deraadt@ guenther@ | |||||
| * | Check for and handle failure of HMAC_{Update,Final} or EVP_DecryptUpdate() | guenther | 2016-10-02 | 1 | -5/+11 | |
| | | | | | | based on openssl commit a5184a6c89ff954261e73d1e8691ab73b9b4b2d4 ok bcook@ | |||||
| * | Detect zero-length encrypted session data early, instead of when malloc(0) | guenther | 2016-10-02 | 1 | -2/+2 | |
| | | | | | | | | fails or the HMAC check fails. Noted independently by jsing@ and Kurt Cancemi (kurt (at) x64architecture.com) ok bcook@ | |||||
| * | Improve on code from the previous commit. | jsing | 2016-09-22 | 1 | -7/+5 | |
| | | | | | ok bcook@ | |||||
| * | Avoid unbounded memory growth, which can be triggered by a client | jsing | 2016-09-22 | 1 | -9/+20 | |
| | | | | | | | repeatedly renegotiating and sending OCSP Status Request TLS extensions. Fix based on OpenSSL. | |||||
| * | Check for packet with truncated DTLS cookie. | guenther | 2016-09-22 | 1 | -12/+17 | |
| | | | | | | | | | | | | Flip pointer comparison logic to avoid beyond-end-of-buffer pointers to make it less likely a compiler will decide to screw you. Based on parts of openssl commits 6f35f6deb5ca7daebe289f86477e061ce3ee5f46 and 89c2720298f875ac80777da2da88a64859775898 ok jsing@ | |||||
| * | Improve ticket validity checking when tlsext_ticket_key_cb() callback | guenther | 2016-09-22 | 1 | -4/+25 | |
| | | | | | | | | | | | | chooses a different HMAC algorithm. Avert memory leaks if the callback preps the HMAC in some way. Based on openssl commit 1bbe48ab149893a78bf99c8eb8895c928900a16f but retaining a pre-callback length check to guarantee the callback is provided the buffer that the API claims. ok bcook@ jsing@ | |||||
| * | Avoid selecting weak digests for (EC)DH when using SNI. | bcook | 2016-09-20 | 1 | -3/+12 | |
| | | | | | | | | | | | | from OpenSSL: SSL_set_SSL_CTX is normally called for SNI after ClientHello has received and the digest to use for each certificate has been decided. The original ssl->cert contains the negotiated digests and is now copied to the new ssl->cert. noted by David Benjamin and Kinichiro Inoguchi | |||||
| * | Update ld search path for libssl/libcrypto, fixes cross-build after source ↵ | bcook | 2016-09-19 | 1 | -3/+3 | |
| | | | | | | | moved. from Patrick Wildt | |||||
| * | Generate pkg-config files at build time like everything else. This | natano | 2016-09-14 | 1 | -2/+3 | |
| | | | | | | | | avoids permission problems due to the build and install stages being run by different users. ok deraadt jasper | |||||
| * | Sort and group functions. | jsing | 2016-09-04 | 1 | -12/+11 | |
| | | ||||||
| * | Expand IMPLEMENT_PEM macros. | jsing | 2016-09-04 | 1 | -2/+29 | |
| | | | | | No change in generated assembly. | |||||
| * | only regen pkg-config files when required; ok jasper | natano | 2016-09-04 | 1 | -3/+5 | |
| | | ||||||
| * | Make tree build again | beck | 2016-09-03 | 3 | -6/+51 | |
| | | ||||||
| * | crank minor for API addiiton of x509_email, etc. functions | beck | 2016-09-03 | 1 | -1/+1 | |
| | | ||||||
| * | Remove the libssl/ssl directory | beck | 2016-09-03 | 2 | -54/+0 | |
| | | ||||||
| * | Remove the libssl/src directory | beck | 2016-09-03 | 1190 | -386114/+0 | |
| | | ||||||
| * | Be more strict when parsing TLS extensions. | jsing | 2016-08-27 | 2 | -34/+74 | |
| | | | | | | | Based on a diff from Kinichiro Inoguchi. ok beck@ | |||||
| * | Do not *printf %s NULL | deraadt | 2016-08-05 | 1 | -2/+3 | |
| | | | | | ok bcook | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |