summaryrefslogtreecommitdiff
path: root/src/lib (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Therefor -> Therefore (where appropriate)tb2016-01-292-2/+2
| | | | from ray@, ok jmc@
* deprecate SSL_OP_SINGLE_DH_USElibressl-v2.3.2beck2016-01-274-74/+12
| | | | ok jsing@
* Don't crash dumping malloc stats if malloc_init hasn't been called, noted byotto2016-01-261-1/+3
| | | | David CARLIER
* Call BIO_sock_init() from tls_init() to ensure sockets are enabled on Windows.bcook2016-01-181-1/+4
| | | | This is of course a no-op on other platforms. Noted by equalsraf from github.
* Long ago, malloc internally had two kinds of failures, warnings and errors.tedu2016-01-062-14/+7
| | | | | | | | The 'A' option elevated warnings to errors, and has been the default for some time. Then warnings were effectively eliminated in favor of everything being an error, but then the 'a' flag turned real errors into warnings! Remove the 'a' option entirely. You shouldn't have used it anyway. ok tb tdeval
* Follow style(9) and drop lint /* NOTREACHED */ annotations fromtb2016-01-042-6/+4
| | | | | | | | the examples. Diff from Juuso Lapinlampi < wub () partyvan ! eu >, thanks! ok schwarze@
* Calling clone(2) with CLONE_NEWPID yields multiple processes with pid=1.bcook2016-01-042-4/+6
| | | | | | | | | | | | | Work around this particular case by reseeding whenever pid=1, but as guenther@ notes, directly calling clone(2), and then forking to match another pid, provides other ways to bypass new process detection on Linux. Hopefully at some point Linux implements something like MAP_INHERIT_ZERO, and does not invent a corresponding mechanism to subvert it. Noted by Sebastian Krahmer and the opmsg team. See http://stealth.openwall.net/crypto/randup.c for a test program. ok beck@
* Document that the ssl free() functions are NULL safe. OK mmcc@millert2015-12-306-12/+42
|
* another case where bad things would happen after wrterrortedu2015-12-301-2/+4
|
* if somebody makes the mistake of disabling abort, don't deref null intedu2015-12-301-2/+4
| | | | validate_junk. from Michal Mazurek
* Remove NULL-checks before free() and a few related dead assignments.mmcc2015-12-282-8/+5
| | | | ok and valuable input from millert@
* remove unused variablechl2015-12-271-2/+1
| | | | ok tedu@
* More adress -> addressmmcc2015-12-244-4/+4
|
* remove NULL-checks before free()mmcc2015-12-236-38/+22
|
* assign pointer NULL rather than 0mmcc2015-12-232-4/+4
|
* assign pointer to NULL rather than 0mmcc2015-12-232-4/+4
|
* initialize a pointer to NULL rather than 0mmcc2015-12-222-4/+4
|
* gethostbyname2() and gethostbyaddr() need <sys/socket.h>; discussed withtim2015-12-191-6/+8
| | | | millert@
* Simplify return call of rand() and rand_r() to make it easier to read.tb2015-12-181-2/+2
| | | | | | | | | This is slightly less robust, but RAND_MAX must be one below a power of two in both variants anyway. Based on a suggestion by Matthew Martin. ok tedu@
* tweak previous;jmc2015-12-162-4/+5
|
* Remove support for HOSTALIASES from the resolver. This "open and parsederaadt2015-12-162-15/+6
| | | | | | | | any file indicated by an environment variable" feature inside the resolver is incompatible with what pledge "dns" is trying to be. It is a misguided "feature" added way back in history which almost noone uses, but everyone has to assume the risk from. ok eric florian kettenis
* Remove "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certificationsthen2015-12-151-49/+0
| | | | | | | | | | | | | | | | | Authority" (serial 3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be) root certificate from cert.pem. ok rpe@ Symantec/VeriSign say "Browsers/root store operators are encouraged to remove/untrust this root from their root stores" and "hasn't been used to generate new certificates in several years, and will now be repurposed to provide transition support for some of our enterprise customers' legacy, non-public applications" (https://www.symantec.com/page.jsp?id=roots, http://www.scmagazine.com/google-will-remove-trust-of-symantecs-pca3-g1-certificate/article/459688/). Also see https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&id=ALERT1941 https://googleonlinesecurity.blogspot.co.uk/2015/12/proactive-measures-in-digital.html
* initialize ext_len to 0.beck2015-12-142-4/+12
| | | | ok guenther@
* initialize ok to 0beck2015-12-142-4/+4
| | | | ok guenther@
* initialize md_len to 0 for readability to quell warnings.beck2015-12-142-6/+6
| | | | ok guenther@
* s/begining/beginning/gmmcc2015-12-141-2/+2
|
* decipher comment. ok bcook@mmcc2015-12-122-4/+4
|
* move initialization of buf up to quell warnings and make it obvious the err ↵beck2015-12-122-8/+10
| | | | | | case is ok. ok bcook@
* prevent possibly use of uninitialized variablebeck2015-12-122-4/+4
| | | | ok bcook@
* make the counter a size_t as well, which quells a warning on visual studio 2015beck2015-12-122-4/+6
| | | | ok bcook@
* tiny sanity check on file sizetedu2015-12-101-1/+3
|
* bump the major for libcrypto/ssl/tls for a CRYPTO_chacha_20 ABI changebcook2015-12-095-10/+10
| | | | ok jsing@, deraadt@, beck@
* Change the counter argument for CRYPTO_chacha_20 to be 64-bits on all platforms.bcook2015-12-094-10/+12
| | | | | | | | | | | The recently-added EVP_aead_chacha20_poly1305_ietf() function, which implements informational RFC 7539, "ChaCha20 and Poly1305 for IETF Protocols", needs a 64-bit counter to avoid truncation on 32-bit platforms. The existing TLS ChaCha20-Poly1305 ciphersuite is not impacted by this, but making this change requires an ABI bump. ok jsing@, "Looks sane" beck@
* Integrate two patches originally from Daniel Micay.tedu2015-12-091-8/+76
| | | | | | | | | | | | 1. Optionally add random "canaries" to the end of an allocation. This requires increasing the internal size of the allocation slightly, which probably results in a large effective increase with current power of two sizing. Therefore, this option is only enabled via 'C'. 2. When writing junk (0xdf) to freed chunks (current default behavior), check that the junk is still intact when finally freeing the delayed chunk to catch some potential use after free. This should be pretty cheap so there's no option to control it separately. ok deraadt tb
* Add root certificate for COMODO RSA Certification Authority, ok beck@sthen2015-12-071-0/+122
| | | | | | | In some cases sites signed by this are covered by the old "AddTrust External CA Root" that we already had, but that depends on the site sending a fairly large chain of intermediate certificates which most aren't doing (because there's no need because this newer one is in browser stores..).
* Remove SHA0 check, as we did in v1.21 of sha.h.bcook2015-12-072-4/+4
| | | | | | This enables ENGINE_get_digest to work again with SHA1. noted by NARUSE, Yui, @nurse from github
* Fix for OpenSSL CVE-2015-3195beck2015-12-042-6/+16
| | | | ok djm@ jsing@
* Fix for OpenSSL CVE-2015-3194beck2015-12-032-4/+4
| | | | ok krw@
* Phrase allocation failure more clearly. ok deraadt@mmcc2015-12-011-3/+3
|
* change Xrs from now-defunct db(3) to dbopen(3); this wasn;t ajmc2015-11-302-6/+6
| | | | | | | straight replace: thanks both to schwarze and maja for feedback on how to rewrite parts; i've snuck in an rcs id->openbsd id change in dev_mkdb too;
* Wrap <icdb.h> so that calls go direct and the symbols are all weakguenther2015-11-251-1/+12
| | | | ok tedu@
* syslog() here is pointless; ok millertderaadt2015-11-251-2/+0
|
* Use reentrant versions of getpw{nam,uid} and getgr{nam,gid} withinmillert2015-11-242-7/+10
| | | | | | | libc to avoid reusing the static buffers returned by the non-reentrant versions. Since this is inside libc we can use constants for the buffer sizes instead of having to call sysconf(). OK guenther@ deraadt@
* Correct file name, no text change (no history yet, but sorry for the churn).schwarze2015-11-242-26/+26
| | | | Issue noticed by jmc@, OK jmc@.
* Document that these functions are now in strings.h.daniel2015-11-247-19/+22
| | | | ok millert@
* Don't fake a bulleted list by prefixing items with 'o'.bentley2015-11-241-8/+8
| | | | ok jmc@
* Partial revert of revision 1.26:schwarze2015-11-211-18/+18
| | | | | Do *not* install the CMS_* manuals for now given that the code is currently disabled. Cluestick applied by jsing@.
* point to netintro(4) rather than (now removed) networking(4);jmc2015-11-212-6/+6
|
* add a version field to prevent mayhem if different data gets storedtedu2015-11-181-3/+7
|
* update for new symbols and codetedu2015-11-181-2/+2
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-05-09 22:13:39 +0000