summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
* After removing support for broken PKCS#8 formats (it was high time),tb2018-08-247-22/+19
| | | | | | | | we can add const to PKCS8_pkey_get0(). In order for this to work, we need to sprinkle a few consts here and there. tested in a bulk by sthen ok jsing
* Remove EVP_PKEY2PKCS8_broken() and PKCS8_set_broken()tb2018-08-245-98/+46
| | | | | | | | | | | Provide PKCS8_pkey_add1_attr_by_NID() and PKCS8_pkey_get0_attrs(). Remove the whole broken code and simplify pkcs8_priv_key_info_st accordingly. Based on OpenSSL commit 54dbf42398e23349b59f258a3dd60387bbc5ba13 plus some const that was added later. tested in a bulk build by sthen ok jsing
* Document const change for OCSP_cert_to_id()tb2018-08-241-4/+4
| | | | ok jsing
* Add const to two arguments of OCSP_cert_to_id()tb2018-08-242-6/+7
| | | | | tested in a bulk by sthen ok jsing
* Provide X509_get0_serialNumber()tb2018-08-243-2/+10
| | | | | tested in a bulk by sthen ok jsing
* Turn a number of #defines into proper functions with prototypes matchingtb2018-08-245-18/+80
| | | | | | those that OpenSSL has had for ages. ok jsing
* Change PEM_Sign{Init,Update}() to return an int.tb2018-08-242-8/+8
| | | | | tested in a bulk by sthen ok jsing
* Check return value of EVP_EncodeUpdate() in PEM_write_bio().tb2018-08-241-2/+3
| | | | ok jsing
* Check return value of EVP_EncodeUpdate() in b64_write().tb2018-08-241-3/+4
| | | | ok jsing
* Convert EVP_EncodeUpdate() to return an int to allow for errortb2018-08-242-8/+10
| | | | | | | | | checking. Matches our documented behavior. Based on OpenSSL commit c5ebfcab713a82a1d46a51c8c2668c419425b387 tested in a bulk by sthen ok jsing
* Provide EVP_CIPHER_CTX_encrypting().tb2018-08-243-2/+10
| | | | | tested in a bulk by sthen ok jsing
* unifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE.jsing2018-08-242-26/+3
| | | | | | This code has been rotting since 2006. ok bcook@ tb@
* Document prototype change and return values for BIO_set_cipher()tb2018-08-241-3/+5
| | | | ok jsing
* Return an int in BIO_set_cipher() to be able to report errors.tb2018-08-242-13/+22
| | | | | tested in a bulk by sthen ok jsing
* In DSO_up_ref(), check return value of CRYPTO_add() and reporttb2018-08-241-3/+5
| | | | | | failure accordingly. ok jsing
* In ENGINE_up_ref(), check return value of CRYPTO_add() and reporttb2018-08-241-3/+5
| | | | | | failure accordingly. ok jsing
* Document new prototype and return values of X509_OBJECT_up_ref_count()tb2018-08-241-3/+6
| | | | ok jsing
* Make X509_OBJECT_up_ref_count return an int.tb2018-08-242-9/+7
| | | | | | | Based on OpenSSL commit c5ebfcab713a82a1d46a51c8c2668c419425b387 tested in a bulk by sthen ok jsing
* Update documentation of CRYPTO_mem_leaks*.tb2018-08-241-6/+12
| | | | ok jsing
* Let CRYPTO_mem_leaks{,_fp,_cb}() return -1.tb2018-08-242-12/+12
| | | | | | | | | These functions are no-ops. Their signature was changed by OpenSSL to allow error checking. This way we return an error and do not indicate the (non-)existence of memory leaks. tested in a bulk by sthen ok jsing
* Simplify session ticket parsing/handling.jsing2018-08-244-69/+46
| | | | | | | | | | | | The original implementation is rather crazy and means that we effectively have two lots of code that parse a ClientHello and two lots of code that parse TLS extensions. Partially simplify this by passing a CBS containing the extension block through to the session handling functions, removing the need to reimplement the ClientHello parsing. While here standarise on naming for session_id and session_id_len. ok inoguchi@ tb@
* Pull up the parsing of a ClientHello.jsing2018-08-241-20/+20
| | | | | | | | | Parse up until the extensions (if any), then proceed with processing, rather than gradually parsing while processing. This makes the code cleaner, requires messages to be valid before processing and makes way for upcoming changes. ok inoguchi@ tb@
* Clean up handshake message start/finish functions.jsing2018-08-246-76/+38
| | | | | | | | Now that all handshake messages are created using CBB, remove the non-CBB ssl3_handshake_msg_start()/ssl3_handshake_msg_finish() functions. Rename the CBB variants by dropping the _cbb suffix. ok bcook@ inoguchi@ tb@
* Correct session ticket encryption.jsing2018-08-221-4/+11
| | | | | | | | | | The CBB conversion resulted in the ticket encryption being handled incorrectly, resulting in only the last block being used. Fix this and restore the previous behaviour. Issue found by inoguchi@ and sebastia@. ok inoguchi@ and tb@
* typo in argument type, from Mario dot Andres dot Campos at gmail dot comschwarze2018-08-211-3/+3
|
* Don't leak sktmp in X509_verify_cert().tb2018-08-191-5/+5
| | | | | | CID #118791 ok jsing mestre
* whitespace fixtb2018-08-191-2/+2
|
* Don't leak db on error in RSA_padding_check_PKCS1_OAEP().tb2018-08-191-7/+7
| | | | | | CID #183499. input & ok jsing, ok mestre on first version
* Rename and collapse tls12_get_sigandhash_cbb().jsing2018-08-194-39/+28
| | | | | | | | | | Now that all callers of tls12_get_sigandhash() have been converted to CBB, collapse tls12_get_sigandhash() and tls12_get_sigandhash_cbb() into a single function. Rename it to tls12_gethashandsig() to be representative of the actual order of the sigalgs parameters, and perform some other clean up. ok inoguchi@ tb@
* Convert ssl3_send_newsession_ticket() to CBB.jsing2018-08-191-55/+64
| | | | | | This removes a memorable BUF_MEM_grow() and associated comment. ok inoguchi@ tb@
* Convert ssl3_send_client_verify() to CBB.jsing2018-08-171-43/+50
| | | | ok inoguchi@ tb@
* Provide CBB_add_u32(), as needed for an upcoming conversion.jsing2018-08-162-2/+17
| | | | ok tb@
* Simplify the add signature code/logic in ssl3_send_server_key_exchange().jsing2018-08-161-13/+8
| | | | ok tb@
* Convert ssl3_send_server_key_exchange() to CBB.jsing2018-08-163-47/+71
| | | | ok inoguchi@ tb@
* Convert ssl3_get_server_key_exchange() to CBS.jsing2018-08-161-69/+55
| | | | ok inoguchi@ tb@
* Add a comment that explains what the check is doing and why len >= 1.tb2018-08-141-1/+2
| | | | Prompted by a remark by jsing
* The UI_add_{input,verify}_string() functions want a length not includingtb2018-08-141-5/+8
| | | | | | | | | | | | | | the terminating NUL. EVP_read_pw_string_min() got this wrong, leading to a one-byte buffer overrun in all callers of EVP_read_pw_string(). Found by mestre running 'openssl passwd' with MALLOC_OPTIONS including C. Fix this by doing some basic sanity checking in EVP_read_pw_string_min(). Cap the len argument at BUFSIZ and ensure that min < len as well as 0 <= min and 1 <= len. The last two checks are important as these numbers may end up in reallocarray(). ok bcook (on previous version), jsing, mestre
* Remove now unused variable, that got left behind from a previous change.jsing2018-08-141-3/+1
|
* Actually check the return values for EVP_Sign* and EVP_Verify*.jsing2018-08-142-15/+23
| | | | ok bcook@ beck@ tb@
* Simplify server key exchange signature verification.jsing2018-08-101-49/+18
| | | | | | Everything can go through the EVP_Verify* code path. ok inoguchi@ tb@
* Simplify server kex exchange signature generation.jsing2018-08-101-61/+33
| | | | | | Everything can go through the single EVP_Sign* code path. ok inoguchi@ tb@
* Add glue to EVP_md5_sha1() so that it can be used with EVP_Sign* andjsing2018-08-101-1/+12
| | | | | | EVP_Verify*. ok tb@
* Add missing include to X25519 synopsis.jsing2018-08-101-2/+3
|
* typo: macro-generates wrappers -> macro-generated wrapperstb2018-08-081-3/+3
|
* Remove unnecessary NULL check from get_cert_by_subject sincelibressl-v2.8.0bcook2018-08-051-3/+3
| | | | | | sk_BY_DIR_HASH_find already does it, removing ambiguity later in the function. ok tb@
* Fix a memory leak in i2d_RSA_NET on failure of ASN1_STRING_set.bcook2018-08-051-2/+2
| | | | | Found by Coverity. Feedback and ok tb@
* In RSA_padding_add_PKCS1_OAEP, dbmask needs to be freed on failure.bcook2018-08-051-3/+7
| | | | ok tb@
* Fix memory leak in i2b_PVK in error handling.bcook2018-08-051-14/+10
| | | | | | | Simplify parameter checks since this is only called from one place. Found by Coverity, CID 183502. ok beck@
* Document that X509_{NAME,REQ,REQ_INFO}_free() are all NULL safe.tb2018-07-292-4/+19
| | | | From Ross L. Richardson
* add c++ symbol annotationsbcook2018-07-241-1/+9
| | | | from Cameron Palmer
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-28 08:39:49 +0000