openbsd - A mirror of https://github.com/libressl/openbsd.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	Rename tls_config_insecure_noverifyhost() to	jsing	2015-02-22	1	-6/+5
\| \| \| \| \| \| \|	tls_config_insecure_noverifyname(), so that it is more accurate and keeps inline with the distinction between DNS hostname and server name. Requested by tedu@ during s2k15.
*	Check return values when setting dheparams and ecdhecurve for the default	jsing	2015-02-22	1	-11/+14
\| \| \| \|	configuration.
*	In the interests of being secure by default, make the default TLS ciphers	jsing	2015-02-22	1	-1/+13
\| \| \| \| \| \| \|	be those that are TLSv1.2 with AEAD and PFS. Provide a "compat" mode that allows the previous default ciphers to be selected. Discussed with tedu@ during s2k15.
*	Add a tls_config_parse_protocols() function that allows a protocols string	jsing	2015-02-12	1	-1/+60
\| \| \| \| \| \| \| \| \|	to be converted into a libtls protocols value. This allows for things like: "tlsv1.0,tlsv1.1" (TLSv1.0 and TLSv1.1) "all,!tlsv1.0" (all protocols except TLSv1.0) Discussed with tedu@ and reyk@
*	Fix handling of "legacy" mode for tls_config_set_dheparams().	jsing	2015-02-12	1	-2/+2
\| \| \| \|	Found by reyk@
*	Be consistent with naming - only use "host" and "hostname" when referring	jsing	2015-02-11	1	-3/+4
\| \| \| \| \| \| \| \| \| \|	to an actual host and use "servername" when referring to the name of the TLS server that we expect to be indentified in the server certificate. Likewise, rename verify_host to verify_name and use the term "name" throughout the verification code (rather than host or hostname). Requested by and ok tedu@
*	Add tls_config_set_dheparams() to allow specification of the parameters to	jsing	2015-02-07	1	-5/+25
\| \| \| \| \| \| \| \| \|	use for DHE. This enables the use of DHE cipher suites. Rename tls_config_set_ecdhcurve() to tls_config_set_ecdhecurve() since it is only used to specify the curve for ephemeral ECDH. Discussed with reyk@
*	Allow to to load the CA chain directly from memory instead of	reyk	2015-01-22	1	-1/+8
\| \| \| \| \| \| \| \|	specifying a file. This enables CA verification in privsep'ed processes that are running chroot'ed without direct access to the certificate files. With feedback, tests, and OK from bluhm@
*	Rename libressl to libtls to avoid confusion and to make it easier to	jsing	2014-10-31	1	-0/+201
	distinguish between LibreSSL (the project) and libressl (the library). Discussed with many.