summaryrefslogtreecommitdiff
path: root/src/lib/libtls (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Split out the TLS server SSL_CTX allocation and configuration code, sojsing2016-08-181-19/+37
| | | | | | that it can be reused to allocate the additional SSL_CTXs needed for SNI. ok reyk@
* Rework parts of the libtls man page for clarity. Split out the connectionjsing2016-08-181-45/+35
| | | | | | | information related functions under their own heading and dedup the text relating to when these functions can be called. With input from and ok jmc@
* The tls_conninfo serial is also unused.jsing2016-08-151-2/+1
|
* Group conninfo fields by connection and peer cert based information,jsing2016-08-151-5/+6
| | | | sort and remove unused fingerprint.
* Fix some style(9) issues.jsing2016-08-151-3/+6
|
* Explicitly pass in an SSL_CTX * to the functions that operate on one,jsing2016-08-154-37/+38
| | | | | | | | | | | instead of assuming that they should use the one associated with the TLS context. This allows these functions to be used with the additional SSL contexts that are needed to support server-side SNI. Also rename tls_configure_keypair() to tls_configure_ssl_keypair(), so that these functions have a common prefix. ok reyk@
* Avoid leaking memory if tls_config_set_alpn() is called multiple timesjsing2016-08-131-4/+5
| | | | (this was in the original commit, but got reverted in the recommit).
* Load CA, certificate and key files into memory when the appropriatejsing2016-08-133-44/+98
| | | | | | | | | | tls_config_set_*_file() function is called. This allows us to immediately propagate useful error messages, play more nicely with privsep/pledge and have a single code path. Instead of always loading the default CA when tls_config_new() is called, defer and only load the default CA when tls_configure() is invoked, if a CA has not already been specified. ok beck@ bluhm@
* Bump libtls minor due to symbol additions.jsing2016-08-121-1/+1
|
* Add ALPN support to libtls.jsing2016-08-127-16/+168
| | | | ok beck@ doug@
* Revert previous since it adds new symbols.jsing2016-08-028-170/+16
| | | | Requested by deraadt@
* Bump TLS_API for addition of ALPN support.jsing2016-08-011-2/+2
|
* Add ALPN support to libtls.jsing2016-08-017-15/+168
| | | | ok beck@ doug@
* Split the existing TLS cipher suite groups into four:jsing2016-07-133-11/+22
| | | | | | | | | | | | "secure" (TLSv1.2+AEAD+PFS) "compat" (HIGH:!aNULL) "legacy" (HIGH:MEDIUM:!aNULL) "insecure" (ALL:!aNULL:!eNULL) This allows for flexibility and finer grained control, rather than having two extremes (an issue raised by Marko Kreen some time ago). ok beck@ tedu@
* Revert previous - it introduces problems with a common privsep use case.jsing2016-07-073-72/+35
|
* Check that the given ciphers string is syntactically valid and results injsing2016-07-061-1/+17
| | | | | | at least one matching cipher suite. ok doug@
* Always load CA, key and certificate files at the time the configurationjsing2016-07-063-35/+72
| | | | | | | | | | function is called. This simplifies code and results in a single memory based code path being used to provide data to libssl. Errors that occur when accessing the specified file are now detected and propagated immediately. Since the file access now occurs when the configuration function is called, we now play nicely with privsep/pledge. ok beck@ bluhm@ doug@
* Correctly handle an EOF that occurs prior to the TLS handshake completing.jsing2016-07-061-3/+6
| | | | | | Reported by Vasily Kolobkov, based on a diff from Marko Kreen. ok beck@
* Rename some of the internal error setting functions to more closely followjsing2016-05-273-14/+48
| | | | | | existing naming standards. Also provide functions for setting a struct tls_error * directly (rather than having to have a struct tls * or a struct tls_config *).
* Avoid leaking ca_mem when freeing a tls_config.jsing2016-05-271-1/+2
|
* Fix function parameters that do not have an underscore prefix.jsing2016-05-271-10/+10
|
* typo fixes; Anthony Coultersthen2016-05-271-3/+3
|
* Fix mangled function signatures.jsing2016-05-091-5/+5
| | | | From Carlin Bingham <cb at viennan dot net>, thanks!
* spelling fix;jmc2016-04-281-2/+2
|
* Crank majors for lib{crypto,ssl,tls} due to symbol removals, symboljsing2016-04-281-1/+1
| | | | additions and functionality changes.
* Factor our the keypair handling in libtls. This results in more readablejsing2016-04-287-52/+164
| | | | | | | | | and self-contained code, while preparing for the ability to handle multiple keypairs. Also provide two additional functions that allow a public certificate and private key to be set with a single function call. ok beck@
* Rework the error handling in libtls so that we can associate errors withjsing2016-04-285-28/+90
| | | | | | | | | | | both configuration and contexts. This allows us to propagate errors that occur during configuration, rather than either just failing with no reason or delaying the failure until it can be propagated via the tls context. Also provide a tls_config_error() function for retrieving the last error from a tls_config *. ok bcook@
* no more outlen; from remcojmc2016-04-241-5/+3
| | | | ok bcook deraadt
* typos;jmc2016-04-241-3/+3
|
* for some time now mandoc has not required MLINKS to functionjmc2016-03-301-52/+1
| | | | | | | | | | | | correctly - logically complete that now by removing MLINKS from base; authors need only to ensure there is an entry in NAME for any function/ util being added. MLINKS will still work, and remain for perl to ease upgrades; ok nicm (curses) bcook (ssl) ok schwarze, who provided a lot of feedback and assistance ok tb natano jung
* Call BIO_sock_init() from tls_init() to ensure sockets are enabled on Windows.bcook2016-01-181-1/+4
| | | | This is of course a no-op on other platforms. Noted by equalsraf from github.
* bump the major for libcrypto/ssl/tls for a CRYPTO_chacha_20 ABI changebcook2015-12-091-2/+2
| | | | ok jsing@, deraadt@, beck@
* update some client/server info; from jan klemkowjmc2015-11-091-5/+5
| | | | ok jsing
* bump minors after adding EVP_aead_chacha20_poly1305_ietf()reyk2015-11-021-1/+1
| | | | OK jsing@
* Put tls_config_verify_client_optional() in the right place.jsing2015-10-161-6/+6
|
* Fix tpyo.jsing2015-10-161-3/+3
|
* fix a gotcha in the connect refactoring, that could result in droppingderaadt2015-10-091-1/+5
| | | | | through and trying to bind failed v6 connects. ok guenther
* If getaddrinfo() succeeds, then don't try look ups with other flags, evenguenther2015-10-081-41/+39
| | | | | | | | | | if the connect()s failed. In concert with some resolver fixes in libc, this lets ntpd be tame()ed problem isolated by theo, who had fun untangling the libc and libtls behaviors to place blame for not being able to tame ntpd ok beck@ deraadt@ jsing@
* trailing whitespace;jmc2015-10-081-6/+6
|
* Add tls_peer_cert_notbefore and tls_peer_cert_notafter to expose peer ↵beck2015-10-076-9/+98
| | | | | | | certificate validity times for tls connections. ok jsing@
* Allow us to get cipher and version even if there is not a peer certificate.beck2015-10-072-15/+21
| | | | ok doug@
* include <sys/types.h> for ssize_tbcook2015-10-011-1/+3
| | | | ok jsing@, deraadt@
* Instead of declaring a union in multiple places, move it to tls_internal.h.jsing2015-09-293-15/+14
| | | | ok deraadt@
* clean some ugly intendation wartsderaadt2015-09-295-12/+21
|
* Explicit NULL checks and style(9) tweaks.jsing2015-09-281-7/+7
|
* tweak previous;jmc2015-09-141-2/+2
|
* Provide tls_config_insecure_noverifytime() in order to be able to disablejsing2015-09-146-6/+29
| | | | | | certificate validity checking. ok beck@
* Remove useless quoting from .Fo and .Fn function names, to preventschwarze2015-09-141-4/+4
| | | | | | development of a cargo cult in case people look at existing files for examples. This achieves a consistent .Fo and .Fn quoting style across the whole tree.
* some conn_version and conn_cipher bits;jmc2015-09-142-9/+10
|
* Expose EOF without close-notify via tls_close().jsing2015-09-142-6/+14
| | | | | | | | | | | Make tls_read(3)/tls_write(3) follow read(2)/write(2) like semantics and return 0 on EOF with and without close-notify. However, if we saw an EOF from the underlying file descriptors without getting a close-notify, save this and make it visible when tls_close(3) is called. This keeps the semantics we want, but makes it possible to detect truncation at higher layers, if necessary. ok beck@ guenther@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 05:17:56 +0000