summaryrefslogtreecommitdiff
path: root/src/lib/libtls (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* backout. diff was not tested comprehensively, resulting in a broken tree.deraadt2018-03-072-22/+14
|
* Make tls_init() concurrently callable using pthread_once().beck2018-03-072-15/+23
| | | | | | | | | | | ok jsing@ This brings pthread_once usage into libressl, which will need to get dealt with correctly in portable. This sets us up to autoinit libtls, and we will also be using pthread_once to deal with autoinit stuff in libssl and libcrypto
* Bump lib{crypto,ssl,tls} minors due to symbol additions.jsing2018-02-221-1/+1
|
* Crank lib{crypto,ssl,tls} minors after symbol addition.tb2018-02-201-1/+1
|
* Bump minor due to symbol addition.tb2018-02-181-1/+1
|
* Bump libcrypto/libssl/libtls minors due to symbol additions.tb2018-02-181-1/+1
|
* Bump libcrypto/libssl/libtls minors due to symbol additions.jsing2018-02-171-1/+1
|
* Bump lib{crypto,ssl,tls} minors due to symbol additions.jsing2018-02-141-1/+1
|
* Be more specific about when the session file will be updated.jsing2018-02-101-2/+2
|
* Bump TLS API version since we've added more functionality.jsing2018-02-101-2/+2
|
* Move the keypair pubkey hash handling code to during config.jsing2018-02-104-69/+95
| | | | | | | | | | | | | | The keypair pubkey hash was being generated and set in the keypair when the TLS context was being configured. This code should not be messing around with the keypair contents, since it is part of the config (and not the context). Instead, generate the pubkey hash and store it in the keypair when the certificate is configured. This means that we are guaranteed to have the pubkey hash and as a side benefit, we identify bad certificate content when it is provided, instead of during the context configuration. ok beck@
* Tidy/standardise some code.jsing2018-02-101-6/+3
|
* Remove NULL check from tls_conninfo_cert_pem() - all of the other conninfojsing2018-02-101-3/+1
| | | | functions require the conninfo passed in to be non-NULL.
* Document functions for client-side TLS session support.jsing2018-02-102-9/+56
|
* Add support to libtls for client-side TLS session resumption.jsing2018-02-106-5/+195
| | | | | | | | | | | | A libtls client can specify a session file descriptor (a regular file with appropriate ownership and permissions) and libtls will manage reading and writing of session data across TLS handshakes. Discussed at length with deraadt@ and tedu@. Rides previous minor bump. ok beck@
* Bump lib{crypto,ssl,tls} minors due to symbol addition.jsing2018-02-101-1/+1
|
* Have tls_keypair_pubkey_hash() call tls_keypair_load_cert() instead ofjsing2018-02-083-14/+11
| | | | | rolling its own certificate loading. This also means we get better error reporting on failure.
* Ensure that tls_keypair_clear() clears the OCSP staple and pubkey hash.jsing2018-02-081-6/+5
|
* Do not bother NULLing pointers in a struct that is about to be freed.jsing2018-02-081-10/+1
|
* Move tls_keypair_pubkey_hash() to the keypair file.jsing2018-02-083-43/+43
|
* Avoid a memory leak that results when the same tls_config is reused.jsing2018-02-081-1/+4
| | | | Reported by and fix from Nate Bessette <openbsd at nate dot sh> - thanks.
* Assert tedu's copyright since some of the code moved here is his.jsing2018-02-081-1/+2
|
* Split keypair handling out into its own file - it had already appearedjsing2018-02-086-166/+215
| | | | | | in multiple locations. ok beck@
* Do not bother NULLing pointers in memory that is freed immediately after.jsing2018-02-051-3/+1
|
* Be consistent with the goto label names used in libtls code.jsing2018-02-054-51/+52
| | | | No change to generated assembly.
* Make tls_config_parse_protocols() work correctly when passed a NULL pointerjsing2017-12-091-3/+5
| | | | | | for a protocol string. Issue found by semarie@, who also provided the diff.
* hyphenate DER/PEM-encoded, for consistency;jmc2017-10-082-9/+9
|
* Document tls_peer_cert_chain_pem().jsing2017-10-071-2/+13
| | | | ok beck@
* If tls_config_parse_protocols() is called with a NULL pointer, return thejsing2017-09-251-1/+4
| | | | | default protocols instead of crashing - this makes the behaviour more useful and mirrors what we already do in tls_config_set_ciphers() et al.
* Keep track of which keypair is in use by a TLS context.jsing2017-09-204-14/+25
| | | | | | | | | | This fixes a bug where by a TLS server with SNI would always only return the OCSP staple for the default keypair, rather than returning the OCSP staple associated with the keypair that was selected via SNI. Issue reported by William Graeber and confirmed by Andreas Bartelt. Fix tested by William Graeber and Andreas Bartelt - thanks!
* Slightly restructure tls_ocsp_verify_cb() to make it more like libtls code.jsing2017-09-201-6/+7
|
* Provide a useful error if there are no OCSP URLs in the peer certificate.jsing2017-09-201-1/+4
|
* Fix indentation.jsing2017-09-201-1/+1
|
* Bump libssl/libtls minors due to symbol (re)addition.jsing2017-08-301-1/+1
|
* Bump lib{crypto,ssl,tls} majors due to symbol removals.jsing2017-08-281-2/+2
|
* Fix unchecked return nitbeck2017-08-281-2/+5
| | | | ok bcook@ jsing@
* Make the symbol for ASN1_time_tm_clamp_notafter visible so libtlsbeck2017-08-271-1/+5
| | | | | can get at it, so libtls can also deal with notafter's past the realm of 32 bit time in portable
* Switch to -Werror with clang for libressl.doug2017-08-131-2/+2
| | | | | Discussed with beck@ and jsing@ ok beck@
* Document tls_config_set_dheparams().jsing2017-08-121-4/+13
|
* Document tls_reset().jsing2017-08-121-2/+13
|
* new sentence, new line;jmc2017-08-111-3/+4
|
* Bump minor due to symbol addition.jsing2017-08-111-1/+1
| | | | Prompted by jsg@, since I apparently left it sitting in my tree...
* Add a tls_config_set_ecdhecurves() function to libtls, which allows thejsing2017-08-107-34/+108
| | | | | | | | | | names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@
* Don't use tls_cert_hash for the hashing used by the engine offloading magicclaudio2017-08-093-11/+24
| | | | | | | | for the TLS privsep code. Instead use X509_pubkey_digest() because only the key should be used as identifier. Relayd is rewriting certificates and then the hash would change. Rename the hash is struct tls_keypair to pubkey_hash to make clear what this hash is about. With input and OK jsing@
* correct function name;jmc2017-08-011-3/+3
| | | | from carlos cardenas
* Document tls_config_set_crl_file() and tls_config_set_crl_mem().jsing2017-07-061-3/+30
| | | | Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks!
* Bump minor due to symbol addition.jsing2017-07-061-1/+1
|
* Add support for providing CRLs to libtls - once a CRL is provided wejsing2017-07-065-4/+67
| | | | | | | | enable CRL checking for the full certificate chain. Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks! Discussed with beck@
* RFC 6066 states that IP literals are not permitted in "HostName" for ajsing2017-07-051-3/+9
| | | | | | | | | | | | TLS Server Name extension, however seemingly several clients (including Python, Ruby and Safari) violate the RFC. Given that this is a fairly widespread issue, if we receive a TLS Server Name extension that contains an IP literal, pretend that we did not receive the extension rather than causing a handshake failure. Issue raised by jsg@ ok jsg@
* Use the tls_password_cb() callback with all PEM_read_bio_*() calls, so thatjsing2017-06-224-11/+14
| | | | | | | we can prevent libcrypto from going behind our back and trying to read passwords from standard input (which we may not be permitted to do). Found by jsg@ with httpd and password protected keys.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 10:17:11 +0000