| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Bump minors due to symbol addition. | jsing | 2017-02-28 | 1 | -1/+1 |
| | | |||||
| * | Stop pretending that MD5 and SHA1 might not exist - rather than locating | jsing | 2017-02-28 | 4 | -20/+8 |
| | | | | | | | | "ssl3-md5" and "ssl-sha1", call the EVP_md5() and EVP_sha1() functions directly. ok beck@ inoguchi@ | ||||
| * | Remove STREEBOG 512 as a TLS MAC since there are currently no cipher suites | jsing | 2017-02-21 | 2 | -26/+6 |
| | | | | | | | that make use of it. ok bcook@ inoguchi@ | ||||
| * | Avoid dereferencing a pointer when reporting an error about the same | jsing | 2017-02-15 | 1 | -2/+2 |
| | | | | | | | pointer being NULL. Found by jsg@ with cppcheck; also detected by Coverity. | ||||
| * | Change SSLerror() back to taking two args, with the first one being an SSL *. | beck | 2017-02-07 | 25 | -573/+841 |
| | | | | | | | | | | Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible | ||||
| * | Define values for SSL_CTRL_SET_GROUPS{,_LIST} and wire them up to the | jsing | 2017-02-05 | 2 | -15/+19 |
| | | | | | | | | | SSL_{,CTX_}ctrl() functions. As crazy as it is, some software appears to call the control functions directly rather than using the macros (or functions) provided by the library. Discussed with beck@ and sthen@ | ||||
| * | Provide an SSL_OP_NO_CLIENT_RENEGOTIATION option that disallows | jsing | 2017-01-31 | 2 | -2/+12 |
| | | | | | | | | client-initiated renegotiation. The current default behaviour remains unchanged. ok beck@ reyk@ | ||||
| * | Send the function codes from the error functions to the bit bucket, | beck | 2017-01-29 | 2 | -4/+4 |
| | | | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@ | ||||
| * | Put comment back in the right place. | jsing | 2017-01-29 | 1 | -9/+9 |
| | | |||||
| * | Avoid clearing the mac_packet flag in the wrong place. | jsing | 2017-01-29 | 1 | -2/+1 |
| | | | | | | | | | In many cases we got away with this, however if a server sends multiple handshake messages in the same record only the first message would be added to the MAC. Should fix breakage reported by various people. | ||||
| * | knf | beck | 2017-01-26 | 1 | -6/+11 |
| | | |||||
| * | Convert ssl3_get_client_hello() to CBS. | jsing | 2017-01-26 | 1 | -76/+71 |
| | | | | | ok beck@ | ||||
| * | Finish the fallout of the SSLerr->SSLerror cleanup to get rid of the ugly | beck | 2017-01-26 | 18 | -653/+335 |
| | | | | | line wraps that resulted | ||||
| * | Send the error function codes to rot in the depths of hell where they belong | beck | 2017-01-26 | 24 | -798/+572 |
| | | | | | | | | We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@ | ||||
| * | Merge the single two line function from ssl_err2.c into ssl_err.c. | jsing | 2017-01-26 | 3 | -76/+12 |
| | | | | | ok beck@ | ||||
| * | english is hard. | beck | 2017-01-26 | 1 | -2/+2 |
| | | |||||
| * | Limit the number of sequential empty records that we will process | beck | 2017-01-26 | 4 | -7/+30 |
| | | | | | | | before yielding, and fail if we exceed a maximum. loosely based on what boring and openssl are doing ok jsing@ | ||||
| * | Refactor the code to generate a WANT_READ into a function, as we are | beck | 2017-01-26 | 1 | -18/+20 |
| | | | | | | using it more and more to avoid spins. ok jsing@ | ||||
| * | Remove most of SSL3_ENC_METHOD - we can just inline the function calls | jsing | 2017-01-26 | 11 | -135/+63 |
| | | | | | | | and defines since they are the same everywhere. ok beck@ | ||||
| * | Move relatively new version range code from ssl_lib.c into a separate | jsing | 2017-01-26 | 3 | -158/+175 |
| | | | | | | | ssl_versions.c file. ok beck@ | ||||
| * | Rename s3_{both,clnt,pkt_srvr}.c to have an ssl_ prefix since they are no | jsing | 2017-01-26 | 5 | -6/+6 |
| | | | | | | | longer SSLv3 code. ok beck@ | ||||
| * | Merge the client/server version negotiation into the existing (currently | jsing | 2017-01-26 | 16 | -1229/+395 |
| | | | | | | | fixed version) client/server code. ok beck@ | ||||
| * | Remove ssl3_undef_enc_method - if we have internal bugs we want to segfault | jsing | 2017-01-26 | 5 | -36/+8 |
| | | | | | | | | so that we can debug it, rather than adding a "should not be called" error to the stack. Discussed with beck@ | ||||
| * | Remove a sess_cert reference from a comment in the public header. | jsing | 2017-01-26 | 1 | -5/+2 |
| | | | | | Noted by zhuk@ | ||||
| * | Limit enabled version range by the versions configured on the SSL_CTX/SSL, | jsing | 2017-01-25 | 3 | -23/+84 |
| | | | | | | | | provide an ssl_supported_versions_range() function which also limits the versions to those supported by the current method. ok beck@ | ||||
| * | Change the SSL_IS_DTLS() macro to check the version, rather than using a | jsing | 2017-01-25 | 2 | -7/+4 |
| | | | | | | | | flag in the encryption methods. We can do this since there is currently only one DTLS version. This makes upcoming changes easier. ok beck@ | ||||
| * | Provide ssl3_packet_read() and ssl3_packet_extend() functions that improve | jsing | 2017-01-25 | 3 | -35/+59 |
| | | | | | | | | the awkward API provided by ssl3_read_n(). Call these when we need to read or extend a packet. ok beck@ | ||||
| * | Provide defines for SSL_CTRL_SET_CURVES/SSL_CTRL_SET_CURVES_LIST for things | jsing | 2017-01-25 | 1 | -1/+15 |
| | | | | | | | | | that are conditioning on these. From BoringSSL. ok beck@ | ||||
| * | BUF_MEM_free(), X509_STORE_free() and X509_VERIFY_PARAM_free() all check | jsing | 2017-01-24 | 2 | -18/+10 |
| | | | | | for NULL, as does lh_free() - do not do the same from the caller. | ||||
| * | sk_free() checks for NULL so do not bother doing it from the callers. | jsing | 2017-01-24 | 4 | -10/+9 |
| | | |||||
| * | sk_pop_free() checks for NULL so do not bother doing it from the callers. | jsing | 2017-01-24 | 7 | -50/+31 |
| | | |||||
| * | Within libssl a SSL_CTX * is referred to as a ctx - fix this for | jsing | 2017-01-24 | 1 | -29/+29 |
| | | | | | SSL_CTX_free(). | ||||
| * | #if 0 the ecformats_list and eccurves_list - these are currently unused but | jsing | 2017-01-24 | 1 | -2/+5 |
| | | | | | will be revisited at some point in the near future. | ||||
| * | Remove unused cert variable. | jsing | 2017-01-24 | 1 | -3/+1 |
| | | | | | Found by bcook@ | ||||
| * | Bump libssl and libtls minors due to symbol additions. | jsing | 2017-01-24 | 1 | -1/+1 |
| | | |||||
| * | Add support for setting the supported EC curves via | jsing | 2017-01-24 | 7 | -26/+197 |
| | | | | | | | | | | | | | | SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous SSL{_CTX}_set1_curves{_list} names. This also changes the default list of EC curves to be X25519, P-256 and P-384. If you want others (such a brainpool) you need to configure this yourself. Inspired by parts of BoringSSL and OpenSSL. ok beck@ | ||||
| * | Correct bounds checks used when generating the EC curves extension. | jsing | 2017-01-24 | 1 | -3/+3 |
| | | | | | ok beck@ | ||||
| * | Fix typo in brainpool curve name within a comment. | jsing | 2017-01-24 | 1 | -2/+2 |
| | | |||||
| * | There is no point returning then breaking... | jsing | 2017-01-24 | 1 | -2/+1 |
| | | |||||
| * | unifdef OPENSSL_NO_BIO - we do not support this in any form. | jsing | 2017-01-24 | 1 | -15/+1 |
| | | | | | ok beck@ | ||||
| * | ssl_cert_free() checks for NULL itself. | jsing | 2017-01-24 | 1 | -10/+5 |
| | | |||||
| * | Remove a "free up if allocated" comment that exists before code that frees | jsing | 2017-01-24 | 1 | -2/+1 |
| | | | | | | | things if they are allocated. ok captainobvious@ | ||||
| * | sk_SSL_CIPHER_free() checks for NULL so do not bother doing the same from | jsing | 2017-01-24 | 4 | -27/+16 |
| | | | | | the callers. | ||||
| * | ssl_sess_cert_free() checks for NULL, so do not bother doing it at the | jsing | 2017-01-24 | 2 | -6/+8 |
| | | | | | call sites. | ||||
| * | There is no point in zeroing fields that exist within a struct that is | jsing | 2017-01-24 | 1 | -3/+1 |
| | | | | | about to be explicit_bzero'd and freed. | ||||
| * | move default_passwd_cb and default_passwd_cb_userdata back into | beck | 2017-01-23 | 4 | -30/+35 |
| | | | | | | | | the ssl_ctx from internal - these are used directly by python and openvpn and a few other things - we have the set accessors but the get accessors were added in 1.1 and these roll their own caveat OPENSSL_VERSION chickenpluckery | ||||
| * | Move options and mode from SSL_CTX and SSL to internal, since these can be | jsing | 2017-01-23 | 12 | -66/+70 |
| | | | | | set and cleared via existing functions. | ||||
| * | Split most of SSL_METHOD out into an internal variant, which is opaque. | jsing | 2017-01-23 | 23 | -303/+378 |
| | | | | | Discussed with beck@ | ||||
| * | Remove ssl_ctrl, ssl_ctx_ctrl, ssl_callback_ctrl and ssl_ctx_callback_ctrl | jsing | 2017-01-23 | 8 | -76/+14 |
| | | | | | | | | from SSL_METHOD, replacing usage with direct calls to the appropriate functions. ok beck@ | ||||
| * | send state and rstate from ssl_st into internal. There are accessors | beck | 2017-01-23 | 16 | -295/+296 |
| | | | | | | so these should not be diddled with directly ok jsing@ | ||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |