summaryrefslogtreecommitdiff
path: root/src/lib (unfollow)
Commit message (Collapse)AuthorFilesLines
2017-09-26bump version in advance of final releasebcook1-3/+3
2017-09-26bump wo 2.6.2libressl-v2.6.2bcook1-3/+3
2017-09-25If tls_config_parse_protocols() is called with a NULL pointer, return thejsing1-1/+4
default protocols instead of crashing - this makes the behaviour more useful and mirrors what we already do in tls_config_set_ciphers() et al.
2017-09-25Annotate some API-side memory leaks for future resolution.jsing1-1/+3
2017-09-25Fix various issues in the OCSP extension parsing code:jsing1-20/+14
- When parsing the OCSP extension we can have multiple responder IDs - pull these out correctly. - Stop using CBS_stow() - it's unnecessary since we just need access to the data and length (which we can get via CBS_data() and CBS_len()). - Use a temporary pointer when calling d2i_*() functions, since it will increment the pointer by the number of bytes it consumed when decoding. The original code incorrectly passes the pointer allocated via CBS_stow() (using malloc()) to a d2i_*() function and then calls free() on the now incremented pointer, most likely resulting in a crash. This issue was reported by Robert Swiecki who found the issue using honggfuzz. ok beck@
2017-09-25When building the OCSP extension, only add the length prefixed extensionsjsing1-6/+6
after we finish building the responder ID list. Otherwise adding to the responder ID list fails. ok beck@
2017-09-23Make delayed free non-optional and make F do an extensive double free check.otto1-21/+26
ok tb@ tedu@
2017-09-20Keep track of which keypair is in use by a TLS context.jsing4-14/+25
This fixes a bug where by a TLS server with SNI would always only return the OCSP staple for the default keypair, rather than returning the OCSP staple associated with the keypair that was selected via SNI. Issue reported by William Graeber and confirmed by Andreas Bartelt. Fix tested by William Graeber and Andreas Bartelt - thanks!
2017-09-20Slightly restructure tls_ocsp_verify_cb() to make it more like libtls code.jsing1-6/+7
2017-09-20Provide a useful error if there are no OCSP URLs in the peer certificate.jsing1-1/+4
2017-09-20Fix indentation.jsing1-1/+1
2017-09-12mapalign returns MAP_FAILED for failuer; from George Koehlerotto1-2/+2
2017-09-11check double free before canary for chunks; ok millert@otto1-5/+5
2017-09-05New POSIX xlocale implementation written from scratch.libressl-v2.6.1schwarze11-96/+396
Complete in the sense that all POSIX *locale(3) and *_l(3) functions are included, but in OpenBSD, we of course only really care about LC_CTYPE and we only support ASCII and UTF-8. With important help from kettenis@, guenther@, and jca@. Repeated testing in ports bulk builds by naddy@. Additional testing by jca@, sebastia@, dcoppa@, and others. OK kettenis@ dcoppa@, and guenther@ on an earlier version. Riding guenther@'s libc/librthread major bump.
2017-09-05Move mutex, condvar, and thread-specific data routes, pthread_once, andguenther2-11/+182
pthread_exit from libpthread to libc, along with low-level bits to support them. Major bump to both libc and libpthread. Requested by libressl team. Ports testing by naddy@ ok kettenis@
2017-09-03Checking sizeof size_t by SIZE_MAX instead of _LP64inoguchi1-7/+7
ok bcook@
2017-09-02delete pointless .Tn ASCII found by jca@ with mandoc -Tlintschwarze1-5/+4
2017-08-31Remove OPENSSL_NO_NEXTPROTONEG - some software creates conflictingjsing1-1/+0
prototypes if we have both OPENSSL_NO_NEXTPROTONEG and the prototypes defined.
2017-08-31Mention strtok_r in STANDARDSjca1-2/+6
POSIX 2001 instead of POSIX.1c suggested by millert@ and jmc@, ok jmc@
2017-08-30Move the full extension building into tlsext_{client,server}hello_build(),jsing2-47/+26
leaving ssl_add_{client,server}hello_tlsext() as pointer to CBB wrappers. ok doug@
2017-08-30Bump libssl/libtls minors due to symbol (re)addition.jsing2-2/+2
2017-08-30Bring back the NPN related symbols.jsing3-3/+36
Several pieces of software make use of these based on a conditional around OPENSSL_NPN_NEGOTIATED, rather than using the presence of the symbols, the non-existence of a OPENSSL_NO_NEXTPROTONEG define or even the existence of the TLS extension type. Unfortunately we cannot remove OPENSSL_NPN_NEGOTIATED since the API for ALPN was effectively botched and reuses two parts from the NPN implementation, rather than providing ALPN specific or generic versions.
2017-08-30Bring back the RSA_SSLV23_PADDING define.jsing1-1/+2
Several pieces of software expect this to be available unconditionally.
2017-08-30Fix ifdef to if in gcm128.cinoguchi1-2/+2
ok deraadt@ bcook@
2017-08-29When OCSP status type is unknown, ignore the extension.doug1-1/+6
This needs to skip past the CBS data or it will be treated as a decode error even though it returns 1. ok jsing@
2017-08-29When parsing extensions by calling the parse functions directly, ensurejsing1-2/+82
that we have consumed all of the extension data. This catches the ALPN extension handling issue that was just fixed.
2017-08-29Actually parse the ALPN extension in a client hello, even if no ALPNjsing1-4/+4
callback has been installed. This ensures that the ALPN extension is valid and avoids leaving unprocessed extension data, which leads to a decode error. Found the hard way by jsg@
2017-08-28ECDHE-RSA-DES-CBC3-SHA should not be marked HIGH.jsing1-2/+2
Spotted by Andreas Bartelt <obsd at bartula dot de>
2017-08-28Some style(9).jsing1-3/+6
2017-08-28Remove chacha20-poly1305-old regress and test vectors.jsing2-627/+0
2017-08-28Remove SSLv23 padding mode.jsing2-7/+5
2017-08-28Bump lib{crypto,ssl,tls} majors due to symbol removals.jsing3-6/+6
2017-08-28Remove EVP_aead_chacha20_poly1305_old() now that the original/oldjsing3-83/+28
chacha20-poly1305 cipher suites have been removed from libssl.
2017-08-28Remove documentation for EVP_aead_chacha20_poly1305_ietf() - this wasjsing1-13/+3
removed/renamed a long time back.
2017-08-28Put the opening curly brace in the right place.jsing1-2/+3
2017-08-28Remove RSA_padding_add_SSLv23()/RSA_padding_check_SSLv23() and relatedjsing9-202/+11
code. We removed SSLv2/SSLv3 a long time ago... Discussed with doug@
2017-08-28Define OPENSSL_NO_NEXTPROTONEG since there is no longer any NPN.jsing1-0/+1
2017-08-28Completely remove NPN remnants.jsing7-107/+9
Based on a diff from doug@, similar diff from inoguchi@
2017-08-28Use current chacha20-poly1305 cipher suite values.jsing1-7/+7
2017-08-28Update due to removal of original chacha20-poly1305 cipher suites.jsing1-42/+39
2017-08-28Remove the original (pre-IETF) chacha20-poly1305 cipher suites.jsing4-73/+5
Support for the IETF standardised chacha20-poly1305 cipher suites was added 16 months ago, which means they exist in both of the currently supported OpenBSD releases. Also prompted by Andreas Bartelt <obsd at bartula dot de>. ok beck@ doug@
2017-08-28Fix unchecked return nitbeck1-2/+5
ok bcook@ jsing@
2017-08-27Rewrite SRTP extension using CBB/CBS and the new extension framework.doug6-275/+652
input + ok beck@, jsing@
2017-08-27check return value from CBB_initbeck1-2/+3
2017-08-27Make the symbol for ASN1_time_tm_clamp_notafter visible so libtlsbeck4-5/+10
can get at it, so libtls can also deal with notafter's past the realm of 32 bit time in portable
2017-08-26Rewrite ALPN extension using CBB/CBS and the new extension framework.doug5-144/+540
ok bcook@ beck@ input + ok jsing@
2017-08-23Work around bug in F5's handling of the supported elliptic curves extension.doug1-2/+16
RFC 4492 only defines elliptic_curves for ClientHello. However, F5 is sending it in ServerHello. We need to skip over it since our TLS extension parsing code is now more strict. Thanks to Armin Wolfermann and WJ Liu for reporting the issue. input + ok jsing@
2017-08-21import SSL_export_keying_material(3) from OpenSSLschwarze3-3/+132
2017-08-21merge the applicable parts of SSL_set_tlsext_host_name(3) documentation;schwarze1-4/+28
from Paul Yang <yang dot yang at baishancloud dot com> via OpenSSL commit 190b9a03 Jun 28 15:46:13 2017 +0800
2017-08-21Selectively merge OpenSSL commit e091367d May 5 11:56:45 2017 +0100schwarze1-16/+15
from Matt Caswell <matt at openssl dot org>. In particular, stop talking about SSL 2.0 and SSL 3.0, but do not start talking about TLS 1.3 just yet.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 11:17:07 +0000