summaryrefslogtreecommitdiff
path: root/src/lib/libssl (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Make ssl_set_{cert,pkey} take an ssl/ctxtb2022-06-291-12/+20
| | | | ok beck jsing
* Refactor use_certificate_chain_* to take ssl/ctx instead of a certtb2022-06-293-21/+45
| | | | ok beck jsing
* Add functions that check security level in certs and cert chains.tb2022-06-292-2/+147
| | | | ok beck jsing
* Make sure the verifier checks the security level in cert chainstb2022-06-291-2/+9
| | | | ok beck jsing
* Remove a confusing commenttb2022-06-291-7/+2
| | | | discussed with jsing
* Parse the @SECLEVEL=n annotation in cipher stringstb2022-06-293-15/+28
| | | | | | | To this end, hand the SSL_CERT through about 5 levels of indirection to set an integer on it. ok beck jsing
* Add support for sending QUIC transport parametersbeck2022-06-297-7/+209
| | | | | | | | | | This is the start of adding the boringssl API for QUIC support, and the TLS extensions necessary to send and receive QUIC transport data. Inspired by boringssl's https://boringssl-review.googlesource.com/24464 ok jsing@ tb@
* whitespace nittb2022-06-291-2/+2
|
* missing blank linetb2022-06-291-1/+2
|
* Also check the security level in SSL_get1_supported_cipherstb2022-06-291-2/+5
| | | | ok beck jsing
* Check security level when convertin a cipher list to bytestb2022-06-291-1/+4
| | | | ok beck jsing
* Also check the security level when choosing a shared ciphertb2022-06-291-1/+5
| | | | ok beck jsing
* There's tentacles, tentacles everywheretb2022-06-291-1/+7
| | | | ok beck jsing
* Also check the security level of the 'tmp dh'tb2022-06-293-3/+24
| | | | ok beck jsing
* Check the security of DH key sharestb2022-06-296-6/+42
| | | | ok beck, looks good to jsing
* Rename one s to ssl for consistencytb2022-06-291-2/+2
|
* Check sigalg security level when selecting them.tb2022-06-291-1/+4
| | | | ok beck jsing
* Check the security bits of the sigalgs' pkeytb2022-06-291-1/+7
| | | | ok beck jsing
* Check the security level when building sigalgstb2022-06-294-12/+20
| | | | ok beck jsing
* Annotate sigalgs with their security level.tb2022-06-292-2/+23
| | | | ok beck jsing
* Add prototypes for ssl{_ctx,}_security()tb2022-06-281-1/+5
| | | | ok beck jsing sthen
* Add error code definstb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Add a period to a commenttb2022-06-281-2/+2
| | | | Pointed out by jsing
* Security level >= 3 requires a ciphersuite with PFStb2022-06-281-3/+4
| | | | ok beck jsing sthen
* Add a secop handler for tmp_dhtb2022-06-281-1/+19
| | | | | | | This disallows DHE keys weaker than 1024 bits at level 0 to match OpenSSL behavior. ok beck jsing sthen
* Add security level related error codes.tb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Sort error stringstb2022-06-281-3/+3
| | | | ok beck jsing sthen
* Implement ssl{,_ctx}_security()tb2022-06-281-1/+15
| | | | ok beck jsing sthen
* Copy the security level stuff in ssl_cert_dup()tb2022-06-281-1/+5
| | | | ok beck jsing sthen
* Set up the default callback in SSL_CERTtb2022-06-281-1/+8
| | | | ok beck jsing sthen
* Implement the default security level callbacktb2022-06-283-2/+202
| | | | | | And here is where the fun starts. The tentacles will grow everywhere. ok beck jsing sthen
* Provide OPENSSL_TLS_SECURITY_LEVEL definetb2022-06-281-1/+7
| | | | ok beck jsing sthen
* Implement SSL_{CTX_}_{g,s}et_security_level(3)tb2022-06-281-1/+25
| | | | ok beck jsing sthen
* Add security callback, level and ex_data fields to SSL_CERTtb2022-06-281-1/+6
| | | | ok beck jsing sthen
* Add #defines and prototypes for security level APItb2022-06-281-1/+72
| | | | | | | This marks the start of one of the worst API additions in the history of this library. And as everybody knows the bar is high. Very high. ok beck jsing sthen
* Free ciphers before assigning to themtb2022-06-281-6/+6
| | | | | | | | While this is not a leak currently, it definitely looks like one. Pointed out by jsing on review of a diff that touched the vicinity a while ago. ok jsing
* Change the loop index from an unsigned int to size_t now that alltb2022-06-071-2/+2
| | | | | | upper bounds are known to be size_t. ok jsing
* Simplify another CBS_write_bytes() call in d2i_SSL_SESSION()tb2022-06-071-5/+2
| | | | ok jsing
* Switch sid_ctx_length in SSL, SSL_CTX and SSL_SESSION to a size_ttb2022-06-071-4/+4
| | | | ok jsing
* Use CBS_write_bytes() instead of manual unpacking of a CBS and assigningtb2022-06-071-3/+5
| | | | | | | length and using memcpy(). This also provides a missing overflow check (which is done by the only caller, however). ok jsing
* Simplify various CBS_write_bytes() callstb2022-06-073-13/+7
| | | | | | | Now that session_id_length is a size_t, we can pass it directly to CBS_write_bytes() instead of using a temporary variable. ok jsing
* Switch SSL_SESSION's session_id_length to a size_ttb2022-06-071-2/+2
| | | | ok jsing
* Add missing error check call in ssl3_get_new_session_ticket()tb2022-06-071-4/+9
| | | | | | | EVP_Digest() can fail, so handle failure appropriately and prepare switch of session_id_length to a size_t. ok jsing
* Another small readability tweak: compare explicitly against 0 and NULL,tb2022-06-071-4/+3
| | | | | | respectively ok jsing
* Tweak readability of a test: compare tmp explicitly against 0 and droptb2022-06-071-2/+2
| | | | | | redundant parentheses. ok jsing
* Add a cast to SSL_SESSION_get_id() to indicate that session_id_lengthtb2022-06-071-2/+2
| | | | | | | is deliberately reduced to an unsigned int. Since the session_id is at most 32 bytes, this is not a concern. ok jsing
* fix indenttb2022-06-071-2/+2
|
* Unindent and simplify remove_session_lock()tb2022-06-071-21/+22
| | | | ok jsing (who informs me he had the same diff in his jungle)
* Drop an unnecessary casttb2022-06-071-2/+2
| | | | ok jsing
* Simplify CBS_write_bytes() invocationtb2022-06-071-5/+2
| | | | | | | Now that master_key_length is a size_t, we no longer have to fiddle with data_len. We can rather pass a pointer to it to CBS_write_bytes(). ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 16:53:59 +0000