summaryrefslogtreecommitdiff
path: root/src/lib/libtls (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Make tls_config_parse_protocols() work correctly when passed a NULL pointerjsing2017-12-091-3/+5
| | | | | | for a protocol string. Issue found by semarie@, who also provided the diff.
* hyphenate DER/PEM-encoded, for consistency;jmc2017-10-082-9/+9
|
* Document tls_peer_cert_chain_pem().jsing2017-10-071-2/+13
| | | | ok beck@
* If tls_config_parse_protocols() is called with a NULL pointer, return thejsing2017-09-251-1/+4
| | | | | default protocols instead of crashing - this makes the behaviour more useful and mirrors what we already do in tls_config_set_ciphers() et al.
* Keep track of which keypair is in use by a TLS context.jsing2017-09-204-14/+25
| | | | | | | | | | This fixes a bug where by a TLS server with SNI would always only return the OCSP staple for the default keypair, rather than returning the OCSP staple associated with the keypair that was selected via SNI. Issue reported by William Graeber and confirmed by Andreas Bartelt. Fix tested by William Graeber and Andreas Bartelt - thanks!
* Slightly restructure tls_ocsp_verify_cb() to make it more like libtls code.jsing2017-09-201-6/+7
|
* Provide a useful error if there are no OCSP URLs in the peer certificate.jsing2017-09-201-1/+4
|
* Fix indentation.jsing2017-09-201-1/+1
|
* Bump libssl/libtls minors due to symbol (re)addition.jsing2017-08-301-1/+1
|
* Bump lib{crypto,ssl,tls} majors due to symbol removals.jsing2017-08-281-2/+2
|
* Fix unchecked return nitbeck2017-08-281-2/+5
| | | | ok bcook@ jsing@
* Make the symbol for ASN1_time_tm_clamp_notafter visible so libtlsbeck2017-08-271-1/+5
| | | | | can get at it, so libtls can also deal with notafter's past the realm of 32 bit time in portable
* Switch to -Werror with clang for libressl.doug2017-08-131-2/+2
| | | | | Discussed with beck@ and jsing@ ok beck@
* Document tls_config_set_dheparams().jsing2017-08-121-4/+13
|
* Document tls_reset().jsing2017-08-121-2/+13
|
* new sentence, new line;jmc2017-08-111-3/+4
|
* Bump minor due to symbol addition.jsing2017-08-111-1/+1
| | | | Prompted by jsg@, since I apparently left it sitting in my tree...
* Add a tls_config_set_ecdhecurves() function to libtls, which allows thejsing2017-08-107-34/+108
| | | | | | | | | | names of the elliptic curves that may be used during client and server key exchange to be specified. This deprecates tls_config_set_ecdhecurve(), which could only be used to specify a single supported curve. ok beck@
* Don't use tls_cert_hash for the hashing used by the engine offloading magicclaudio2017-08-093-11/+24
| | | | | | | | for the TLS privsep code. Instead use X509_pubkey_digest() because only the key should be used as identifier. Relayd is rewriting certificates and then the hash would change. Rename the hash is struct tls_keypair to pubkey_hash to make clear what this hash is about. With input and OK jsing@
* correct function name;jmc2017-08-011-3/+3
| | | | from carlos cardenas
* Document tls_config_set_crl_file() and tls_config_set_crl_mem().jsing2017-07-061-3/+30
| | | | Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks!
* Bump minor due to symbol addition.jsing2017-07-061-1/+1
|
* Add support for providing CRLs to libtls - once a CRL is provided wejsing2017-07-065-4/+67
| | | | | | | | enable CRL checking for the full certificate chain. Based on a diff from Jack Burton <jack at saosce dot com dot au>, thanks! Discussed with beck@
* RFC 6066 states that IP literals are not permitted in "HostName" for ajsing2017-07-051-3/+9
| | | | | | | | | | | | TLS Server Name extension, however seemingly several clients (including Python, Ruby and Safari) violate the RFC. Given that this is a fairly widespread issue, if we receive a TLS Server Name extension that contains an IP literal, pretend that we did not receive the extension rather than causing a handshake failure. Issue raised by jsg@ ok jsg@
* Use the tls_password_cb() callback with all PEM_read_bio_*() calls, so thatjsing2017-06-224-11/+14
| | | | | | | we can prevent libcrypto from going behind our back and trying to read passwords from standard input (which we may not be permitted to do). Found by jsg@ with httpd and password protected keys.
* Fix incorrect indentation.jsing2017-06-221-2/+2
|
* Plug a memory leak in tls_keypair_cert_hash(), introduced in r1.60.jsing2017-06-221-1/+3
|
* Remove dead code that has remained hiding since ressl.c r1.14!jsing2017-06-221-4/+1
|
* Use the standard `rv' idiom in tls_keypair_load_cert(), rather thanjsing2017-06-221-5/+4
| | | | duplicating clean up code.
* Plug a memory leak. The main_cert needs to be X509_free()ed sinceclaudio2017-05-161-0/+2
| | | | | | SSL_get_peer_certificate() increases the ref count whereas extra_certs do not because SSL_get_peer_cert_chain() won't increase ref counts. OK beck@
* Ensure that a client context has been connected before attempting tojsing2017-05-072-4/+12
| | | | complete a TLS handshake.
* Return an error if tls_handshake() is called on a TLS context that hasjsing2017-05-071-1/+6
| | | | already completed a TLS handshake.
* Use freezero() for the tls_load_file() failure case, since we'rejsing2017-05-061-4/+4
| | | | | | potentially dealing with key material. Also switch a calloc to malloc, since we immediately copy the same amount of data to the newly allocated buffer.
* BIO_free_all() and EVP_PKEY_free() can be called with NULL.jsing2017-05-061-5/+3
|
* Be explicit about when it is safe to call tls_config_free().jsing2017-05-061-3/+8
| | | | Discussed with beck@
* Document tls_unload_file().jsing2017-05-061-3/+14
|
* Perform reference counting for tls_config. This allows tls_config_free() tojsing2017-05-064-6/+22
| | | | | | | | | be called as soon as it has been passed to the final tls_configure() call, simplifying lifetime tracking for the application. Requested some time ago by tedu@. ok beck@
* Provide a tls_unload_file() function, that frees the memory returned fromjsing2017-05-063-2/+10
| | | | | | | | a tls_load_file() call, ensuring that it the contents become inaccessible. This is specifically needed on platforms where the library allocators may be different from the application allocator. ok beck@
* Bump minors for symbol addition in libcryptobeck2017-05-061-1/+1
| | | | ok jsing@
* Move tls_config_skip_private_key_check() out from under HIDDEN_DECLS.claudio2017-05-041-2/+4
| | | | | | Even though this is not a real public interface we need the symbol in the shared library so that relayd can use it (needed for TLS key privsep) OK beck@
* use freezero() instead of memset/explicit_bzero + free. Substantiallyderaadt2017-05-021-4/+2
| | | | | | | | | | reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
* Only enable -Werror on libcrypto/libssl/libtls if we are building withjsing2017-04-301-2/+5
| | | | | | | gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@
* Add a tls_keypair_clear_key() function that uses freezero() to make keyjsing2017-04-301-5/+11
| | | | | | material inaccessible, then call it from the appropriate places. ok beck@
* tls_free(3) and tls_config_free(3) accept NULL;schwarze2017-04-272-4/+14
| | | | | patch from Matthew Martin <phy1729 at gmail dot com>, slightly tweaked by me
* Rework name verification code so that a match is indicated via an argument,jsing2017-04-105-47/+76
| | | | | | | | | | rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg <daniel at haxx dot se>. ok beck@ jca@
* Use uint8_t instead of u_int8_t - for consistency and to make things easierjsing2017-04-071-2/+2
| | | | | | for portable. From Raphael Hittich.
* Add tls_peer_cert_chain_pem - To retreive the peer certificate and chainbeck2017-04-057-6/+77
| | | | | | | as PEM format. This allows for it to be used or examined with tools external to libtls bump minor ok jsing@
* Internal changes to allow for relayd engine privsep. sends the hash of thebeck2017-04-055-29/+87
| | | | | | public key as an identifier to RSA, and adds an function for relayd to use to disable private key checking when doing engine privsep. ok jsing@
* fix error in Dt; from robert kleinjmc2017-03-021-3/+3
|
* Bump minors due to symbol addition.jsing2017-02-281-1/+1
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 23:34:20 +0000