| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Add the following root CAs, from SECOM Trust Systems / Security Communication | sthen | 2017-02-24 | 1 | -1/+126 | |
| | | | | | | | | | of Japan, they are present in Mozilla's CA store. OK ajacoutot@ /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1 /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 /C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1 | |||||
| * | Remove STREEBOG 512 as a TLS MAC since there are currently no cipher suites | jsing | 2017-02-21 | 2 | -26/+6 | |
| | | | | | | | that make use of it. ok bcook@ inoguchi@ | |||||
| * | don;t end Nd with a full stop; | jmc | 2017-02-21 | 1 | -3/+3 | |
| | | ||||||
| * | Mark ERR_add_error_data and ERR_add_error_vdata as not for internal use, | beck | 2017-02-20 | 5 | -14/+81 | |
| | | | | | | and document ERR_asprintf_error_data as their replacement. ok jsing@, ingo@ | |||||
| * | spelling fix; | jmc | 2017-02-20 | 1 | -2/+2 | |
| | | ||||||
| * | document tls_config_error(3) RETURN VALUES, improve what is said | schwarze | 2017-02-20 | 2 | -6/+59 | |
| | | | | | | about tls_error(3), and warn about some traps; OK jmc@ | |||||
| * | Add EDNS0 support. | jca | 2017-02-18 | 1 | -4/+3 | |
| | | | | | | | | EDNS allows for various DNS extensions, among which UDP DNS packets size bigger than 512 bytes. The default is still to not advertize anything. ok eric@ | |||||
| * | Avoid dereferencing a pointer when reporting an error about the same | jsing | 2017-02-15 | 1 | -2/+2 | |
| | | | | | | | pointer being NULL. Found by jsg@ with cppcheck; also detected by Coverity. | |||||
| * | Add a NULL test to wrterror() to avoid a NULL deref when called from a | jsg | 2017-02-15 | 1 | -2/+2 | |
| | | | | | | | free() error path. ok otto@ | |||||
| * | bump to 2.5.2 | bcook | 2017-02-14 | 1 | -3/+3 | |
| | | ||||||
| * | malloc does not *need* to return page-aligned objects for size >= | otto | 2017-02-12 | 1 | -5/+2 | |
| | | | | | | a page. This is not required by any standard and other malloc implementation do not document (or implement) this. ok deraadt@ | |||||
| * | DES keys are not 7 days long. ok jsing@ | dtucker | 2017-02-09 | 2 | -5/+5 | |
| | | ||||||
| * | Revert previous; the implementation is incorrect since it assumes that the | jsing | 2017-02-07 | 2 | -20/+7 | |
| | | | | | | provided error code matches the error that is currently on the top of the error stack. | |||||
| * | Add file and line to the LibreSSL error strings sine we are no longer in | beck | 2017-02-07 | 2 | -7/+20 | |
| | | | | | | | | 1989, VMS, or MS/DOS and we all run Brobdingnagian C compilers that have can now be counted on to achieve this level of sophistication nearly everywhere. ok jsing@ | |||||
| * | Change SSLerror() back to taking two args, with the first one being an SSL *. | beck | 2017-02-07 | 25 | -573/+841 | |
| | | | | | | | | | | Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible | |||||
| * | Define values for SSL_CTRL_SET_GROUPS{,_LIST} and wire them up to the | jsing | 2017-02-05 | 2 | -15/+19 | |
| | | | | | | | | | SSL_{,CTX_}ctrl() functions. As crazy as it is, some software appears to call the control functions directly rather than using the macros (or functions) provided by the library. Discussed with beck@ and sthen@ | |||||
| * | Kill leak introduced with refactor | beck | 2017-02-05 | 1 | -3/+6 | |
| | | | | | ok jsing@ | |||||
| * | fix a comment and rm some dead code as a result of the previous diff | otto | 2017-02-02 | 1 | -8/+5 | |
| | | ||||||
| * | Let realloc handle and produce moved pointers for allocations betweenlibressl-v2.5.1 | otto | 2017-02-01 | 1 | -20/+37 | |
| | | | | | half a page and a page. ok jmatthew@ tb@ | |||||
| * | tweak previous; | jmc | 2017-01-31 | 2 | -12/+8 | |
| | | ||||||
| * | Add tls_config_[add|set]keypair_ocsp functions so that ocsp staples may be | beck | 2017-01-31 | 6 | -58/+209 | |
| | | | | | | | | | added associated to a keypair used for SNI, and are usable for more than just the "main" certificate. Modify httpd to use this. Bump libtls minor. ok jsing@ | |||||
| * | Disable client-initiated renegotiation for libtls servers. | jsing | 2017-01-31 | 1 | -1/+3 | |
| | | | | | ok beck@ reyk@ | |||||
| * | Provide an SSL_OP_NO_CLIENT_RENEGOTIATION option that disallows | jsing | 2017-01-31 | 2 | -2/+12 | |
| | | | | | | | | client-initiated renegotiation. The current default behaviour remains unchanged. ok beck@ reyk@ | |||||
| * | LibreSSL : Truncated packet could crash via OOB read | inoguchi | 2017-01-31 | 2 | -3/+10 | |
| | | | | | | | | | This patch is originally from master branch of OpenSSL. - 2198b3a crypto/evp: harden AEAD ciphers. - 8e20499 crypto/evp: harden RC4_MD5 cipher. ok tom@ | |||||
| * | Document functions returning standard moduli for DH key exchange. | schwarze | 2017-01-31 | 2 | -1/+136 | |
| | | | | | jsing@ confirmed that these are public and worth documenting. | |||||
| * | tweak previous; | jmc | 2017-01-30 | 3 | -11/+11 | |
| | | ||||||
| * | Document BN_set_flags(3) and BN_get_flags(3). | schwarze | 2017-01-30 | 6 | -13/+159 | |
| | | | | | jsing@ confirmed that these macros are public and worth documenting. | |||||
| * | Seriously warn against calling BN_init(3), BN_MONT_CTX_init(3), | schwarze | 2017-01-29 | 3 | -12/+75 | |
| | | | | | | | | and BN_RECP_CTX_init(3). They are not only deprecated but so dangerous that they are almost unusable. I found these scary traps while reading the code in order to document BN_set_flags(3). While here, delete ERR_get_error(3) from SEE ALSO. | |||||
| * | Marko Kreen contributed significantly to the ocsp stuff for libtls | beck | 2017-01-29 | 1 | -2/+3 | |
| | | ||||||
| * | Move the ocsp staple to being part of the keypair structure internally, | beck | 2017-01-29 | 3 | -14/+32 | |
| | | | | | | | | so that it does not send back bogus staples when SNI is in use. (Further change is required to be able to use staples on all keypairs and not just the main one) ok jsing@ | |||||
| * | Send the function codes from the error functions to the bit bucket, | beck | 2017-01-29 | 275 | -3892/+2400 | |
| | | | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@ | |||||
| * | Put comment back in the right place. | jsing | 2017-01-29 | 1 | -9/+9 | |
| | | ||||||
| * | Avoid clearing the mac_packet flag in the wrong place. | jsing | 2017-01-29 | 1 | -2/+1 | |
| | | | | | | | | | In many cases we got away with this, however if a server sends multiple handshake messages in the same record only the first message would be added to the MAC. Should fix breakage reported by various people. | |||||
| * | add HISTORY and AUTHORS | schwarze | 2017-01-28 | 12 | -24/+256 | |
| | | ||||||
| * | Fix Copyright notices; ok beck@ jsing@ tedu@ | schwarze | 2017-01-27 | 11 | -28/+43 | |
| | | ||||||
| * | More s/OSCP/OCSP/ typos | tom | 2017-01-27 | 1 | -1/+1 | |
| | | | | | ok jmc@ | |||||
| * | fix Dt; | jmc | 2017-01-26 | 1 | -3/+3 | |
| | | ||||||
| * | Use a flag to track when we need to call SSL_shutdown(). This avoids an | jsing | 2017-01-26 | 4 | -5/+11 | |
| | | | | | | | | | | issue where by calling tls_close() on a TLS context that has not attempted a handshake, results in an unexpected failure. Reported by Vinay Sajip. ok beck@ | |||||
| * | Bump TLS_API due to new features being added earlier this week. | jsing | 2017-01-26 | 1 | -2/+2 | |
| | | ||||||
| * | Bump libtls minor due to symbol additions earlier this week. | jsing | 2017-01-26 | 1 | -1/+1 | |
| | | ||||||
| * | knf | beck | 2017-01-26 | 1 | -6/+11 | |
| | | ||||||
| * | Convert ssl3_get_client_hello() to CBS. | jsing | 2017-01-26 | 1 | -76/+71 | |
| | | | | | ok beck@ | |||||
| * | Finish the fallout of the SSLerr->SSLerror cleanup to get rid of the ugly | beck | 2017-01-26 | 18 | -653/+335 | |
| | | | | | line wraps that resulted | |||||
| * | Hide SSLerr() under #ifndef LIBRESSL_INTERNAL since we shouldn't be | beck | 2017-01-26 | 1 | -2/+4 | |
| | | | | | | using it anymore ok jsing@ | |||||
| * | Send the error function codes to rot in the depths of hell where they belong | beck | 2017-01-26 | 24 | -798/+572 | |
| | | | | | | | | We leave a single funciton code (0xFFF) to say "SSL_internal" so the public API will not break, and we replace all internal use of the two argument SSL_err() with the internal only SSL_error() that only takes a reason code. ok jsing@ | |||||
| * | Merge the single two line function from ssl_err2.c into ssl_err.c. | jsing | 2017-01-26 | 3 | -76/+12 | |
| | | | | | ok beck@ | |||||
| * | english is hard. | beck | 2017-01-26 | 1 | -2/+2 | |
| | | ||||||
| * | Limit the number of sequential empty records that we will process | beck | 2017-01-26 | 4 | -7/+30 | |
| | | | | | | | before yielding, and fail if we exceed a maximum. loosely based on what boring and openssl are doing ok jsing@ | |||||
| * | Refactor the code to generate a WANT_READ into a function, as we are | beck | 2017-01-26 | 1 | -18/+20 | |
| | | | | | | using it more and more to avoid spins. ok jsing@ | |||||
| * | Remove most of SSL3_ENC_METHOD - we can just inline the function calls | jsing | 2017-01-26 | 11 | -135/+63 | |
| | | | | | | | and defines since they are the same everywhere. ok beck@ | |||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |