summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Expand a new macro that tried to get away...jsing2019-08-111-2/+8
|
* Expand ASN.1 macros.jsing2019-08-118-273/+1544
|
* We use DECLARE_STACK_OF rather than DEFINE_STACK_OF.jsing2019-08-112-7/+7
|
* Unlike OpenSSL we do not have our own special ssize_t.jsing2019-08-113-9/+9
|
* Re-convert and re-import the CMS manual pages from OpenSSL 1.1.1schwarze2019-08-1021-0/+3388
| | | | | | | (which are still under a free license) with pod2mdoc(1) now that jsing@ has begun work to provide these APIs. Some formatting was improved and some typos were fixed, but apart from that, little was changed, so there is still much to polish.
* Fix style(9) and whitespace.jsing2019-08-101-210/+205
|
* More style(9) and whitespace.jsing2019-08-101-335/+294
|
* More style(9), whitespace and readability fixes.jsing2019-08-1014-675/+903
| | | | Files are identical once whitespace and newlines are removed.
* First pass at style(9).jsing2019-08-1014-4174/+4174
| | | | Whitespace only and no change according to diff -w.
* Fix includes for non-installed headers.jsing2019-08-109-25/+25
|
* Include cms.h instead of cmserr.h.jsing2019-08-101-2/+2
|
* Add $OpenBSD$ tag.jsing2019-08-101-0/+1
|
* Restore the per-file license for cms.h.jsing2019-08-101-5/+49
| | | | | This reverts the removal from OpenSSL 21dcbebc6e35419f1842f39a125374ea1ba45693.
* Provide cms.h.jsing2019-08-101-0/+515
| | | | | This is OpenSSL 1.1.1 cms.h and cmserr.h combined, essentially reverting OpenSSL 52df25cf2e656146cb3b206d8220124f0417d03f.
* Add $OpenBSD$ tags.jsing2019-08-1015-0/+15
|
* Restore the original per-file licenses for CMS.jsing2019-08-1014-70/+686
| | | | These were removed in OpenSSL b1322259d93cf6b6286f9febcd468b6a9f577d91.
* Work towards supporting Cryptographic Message Syntax (CMS) in libcrypto.jsing2019-08-1015-0/+6172
| | | | | | | | | | | | | | | | Cryptographic Message Syntax (CMS) is a standard for cryptographically protecting messages, as defined in RFC 5652. It is derived from PKCS #7 version 1.5 and utilises various ASN.1 structures, making it complex and fairly heavyweight. Various protocols - including RPKI (RFC 6480) - have been built on top of it, which means it is necessary to support CMS, in order to support RPKI. This imports around 6,000 lines of code from OpenSSL 1.1.1, which is still under the original OpenSSL license. Further work will occur in tree. Requested by and discussed with many. ok deraadt@ tb@
* correct mispellings of EACCES; from Kris Katterjohnlibressl-v3.0.0deraadt2019-07-291-3/+3
|
* explain the acronym "CRT"; suggested by tb@schwarze2019-07-132-6/+8
|
* Using pthread_atfork instead of __register_atfork with uClibc on noMMUinoguchi2019-07-111-2/+2
| | | | | | | | uClibc on noMMU doesn't provide __register_atfork(). Reported by redbirdtek on Github issue. https://github.com/libressl-portable/portable/issues/538 ok bcook@
* Group tls_{handshake,read,write,close}() return values documentation.jsing2019-07-091-21/+21
| | | | | | | | | | Move the documentation for tls_error() down so that both the special return values for tls_{handshake,read,write,close}() directly follow the standard return values for the same functions. Prompted by deraadt@. ok deraadt@ schwarze@
* Clean up pvkfmt.cinoguchi2019-07-081-63/+66
| | | | | | | | | | | - Replace EVP_CIPHER_CTX_init with EVP_CIPHER_CTX_new and handle return value - Replace EVP_CIPHER_CTX_cleanup with EVP_CIPHER_CTX_free - Change two 'return -1;' to 'goto err;' for avoiding leak - Remove the case if enclevel == 0 - Change enclevel checking to make more consistent - Change all goto label to 'err' and insert space before goto label ok and advise from tb@
* Fix pvk format processing in libcryptoinoguchi2019-07-071-11/+11
| | | | | | | | - Return the valid pointer in i2b_PVK() - Use EVP_Decrypt* instead of EVP_Encrypt* - Fix error handling after BIO_write() in i2b_PVK_bio() ok tb@
* improve verb-tense for explaining the calling convention of __deraadt2019-07-051-3/+3
| | | | ok guenther jmc
* The last consumer of pre-posix realpath behaviour has stoppedderaadt2019-07-051-34/+3
| | | | | | | | requiring it (sftp-server). Remove the /exists///// behaviour from here. The /nonexistant behaviour remains in the kernel and needs to be shot next. There may be ports fallout, but we doubt it. ok beck djm
* snprintf/vsnprintf return < 0 on error, rather than -1.deraadt2019-07-033-7/+7
|
* Add cpuid support for arm64 so that we can recognize whichpatrick2019-07-023-3/+57
| | | | | | hardware crypto features are available. "no objections" kettenis@
* tweak previous; ok guentherjmc2019-06-301-5/+6
|
* Document that getcwd() and realpath() are built on system calls thatguenther2019-06-291-2/+16
| | | | | | | have a different calling convention than the standard function...as seen in kdump output. ok deraadt@ schwarze@
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-284-12/+12
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* failed to detect asprintf() error by observing return of -1, instead thederaadt2019-06-281-6/+3
| | | | | code was inspecting the pointer (which is, sadly, undefined on error, because the current specification of asprintf is crazy sloppy)
* The C89 standard only requires that atexit(3) returns a non-zero valueschwarze2019-06-271-5/+12
| | | | | | on error, so checking for -1 only is potentially non-portable. Also mention that the C89 standard does not require errno to be set. OK deraadt@ millert@
* tls_read() & tls_write() return 4 possible values: TLS_WANT_POLLOUT,deraadt2019-06-201-4/+4
| | | | | | TLS_WANT_POLLIN, -1, or 0. After handling the first two, check for -1 rather than vaguely "< 0". ok jsing
* sockatmark(3), recv(2), getsockopt(2), and connect(2) return specificallyderaadt2019-06-201-4/+4
| | | | | -1 to mark failure, not arbitrary values < 0. I believe manual pages should follow the described contract precisely and accurately.
* Make BN_num_bits_word() constant time.tb2019-06-171-48/+18
| | | | | | | | | | | | | | | | | Previously, this function would leak the most significant word of its argument due to branching and memory access pattern. This patch is enough to fix the use of BN_num_bits() on RSA prime factors in the library. The diff is a simplified and more readable (but perhaps less efficient) version of https://github.com/openssl/openssl/commit/972c87df by Andy Polyakov and David Benjamin (pre license change). Consult that commit message for details. Subsequent fixes to follow in the near future. Issue pointed out by David Schrammel and Samuel Weiser as part of a larger report. tests & ok inoguchi, ok jsing
* Remove old realpath(3), and the userland-vs-kernel realpath verificationderaadt2019-06-171-334/+44
| | | | | | | | code. We now user the simple userland wrapper on top of __realpath(2). The non-POSIX behaviour still remains, that is the next component to fix. From a diff by beck, but I managed to chainsaw it a bit further. Tested in snaps for a couple of days. ok beck
* oops - missing .El in previous;jmc2019-06-151-1/+2
|
* realpath(3) doesn't use lstat(2), readlink(2), or getcwd(3) anymore,deraadt2019-06-151-21/+39
| | | | | | it is a thin wrapper over the syscall __readlink(2). Improve the list of possible errors. ok millert beck jmc
* Improve pages that briefly mentioned ERR - usually below SEE ALSO -schwarze2019-06-1420-124/+198
| | | | | but failed to provide any real information. OK tb@ jmc@
* Further improve the documentation of library initialization and configuration.schwarze2019-06-149-94/+126
| | | | | | | | | Among other improvements: * Use a uniform wording at the top of the DECSRIPTION for obsolete pages. * Better explain how to use a non-standard configuration file. * Remove obsolete functions from SEE ALSO. Triggered by some suggestions from tb@. Tweaks and OK tb@.
* add missing backlinks to ssl(3)schwarze2019-06-1231-64/+100
|
* List all 17 SSL pages that were missing.schwarze2019-06-121-51/+89
| | | | | | Split some excessively long lists into useful sub-categories. Add a new, very short subsection "Obsolete functions" at the end. OK tb@ jmc@
* delete references to ERR pages from SEE ALSO where suchschwarze2019-06-1035-115/+79
| | | | references were already given below RETURN VALUES right above
* add links back to crypto(3) to function group entry pagesschwarze2019-06-1022-45/+70
| | | | | and to isolated obsolete pages; OK bcook@ jmc@
* remove pointless NOTES section header linesschwarze2019-06-089-27/+27
|
* Delete the display of the RSA_METHOD objectschwarze2019-06-081-70/+1
| | | | | | | | | | which is now supposed to be opaque. OK tb@ I checked that all the information contained in comments in the display is available from the appropriate places in RSA_meth_new(3) and RSA_set_flags(3). Note that the comments regarding "mod_exp", "init", and "finish" were half-misleading simplifications, anyway.
* In rsa.h rev. 1.40, gilles@ provided several new RSA_METHOD accessors.schwarze2019-06-085-46/+499
| | | | | Update the documentation. OK tb@ jmc@
* document the RSA_FLAG_* constants for RSA_*_flags(3);schwarze2019-06-081-3/+76
| | | | OK tb@ jmc@
* Remove the last references to the RAND_*(3) functions.schwarze2019-06-0712-47/+34
| | | | | | These references were misleading because these functions are no longer used internally and applications should not call them either. Issue brought up by tb@.
* link to EVP_EncodeInit(3), which was the only missing child pageschwarze2019-06-071-1/+6
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 22:54:52 +0000