summaryrefslogtreecommitdiff
path: root/src (unfollow)
Commit message (Collapse)AuthorFilesLines
2015-09-11Provide tls_peer_cert_hash() which returns a hash of the raw certificatejsing3-2/+92
that was presented by the peer. The hash used is currently SHA256, however since we prefix the result with the hash name, we can change this in the future as the need arises. The same output can be generated by using: h=$(openssl x509 -outform der -in mycert.crt | sha256) printf "SHA256:${h}\n" ok beck@
2015-09-11_getnetbyaddr and _getnetbyname appear to be historical accidents inderaadt3-103/+2
our tree. ok guenther miod
2015-09-11remove stupid castsderaadt1-4/+4
2015-09-11Store a reference to the peer certificate (if any) upon completion of thejsing2-2/+8
handshake. Free the reference when we reset the TLS context. ok beck@
2015-09-11Wrap blowfish, sha*, md5, and rmd160 so that internal calls go directguenther2-2/+24
ok deraadt@
2015-09-11specify what is permitted as an argument to tls_config_set_ciphers()beck1-1/+11
2015-09-11actually set return value to 0 on success.beck1-1/+2
ok jsing@ who wears the cone of shame.
2015-09-11- add some missing NAME entriesjmc1-6/+8
- zap trailing whitespace - avoid "can not"
2015-09-11sort MLINKS into the same order as the man page;jmc1-4/+4
2015-09-11shutdown (n.) -> shut down (v.);jmc1-2/+2
2015-09-11Change the default behavior of the s_time command so that it willlteo1-2/+7
perform a proper shutdown by sending a "close notify" alert to the server. This allows s_time to benchmark a full TLS connection more accurately. Introduce a new flag called -no_shutdown to make s_time adopt the previous behavior (i.e. shut down the connection without notifying the server) so that comparisons can still be made with OpenSSL's version. The idea of using a flag (which replaces a #define) was suggested by bcook@. Thanks to millert@ and miod@ as well for their feedback on an earlier diff which resulted in this change. ok bcook@ beck@
2015-09-11*** empty log message ***lteo1-19/+24
2015-09-10Nuke references to DTLS1_BAD_VER and unbreak the tree.jsing1-5/+2
2015-09-10Add support for building arc4random with MSVC.bcook1-7/+8
By default, MSVC's stdlib.h defines min(), so we need to spell out something less common to avoid picking it up. ok deraadt@ beck@ miod@
2015-09-10Call tls_set_errorx() instead of tls_set_error() injsing1-5/+5
tls_configure_ssl_verify(). Also tweak an error message and unwrap a line.
2015-09-10Pull in namespace.h when building all .c files using gcc's -include option,guenther2-3/+18
so that we can provide asm labels for the memcpy/memset/__stack_smash_handler calls that it generates ab initio. Eliminate direct #includes of it. Make sure it's a dependency of all objects (unnecessary for asm, but close enough). ok deraadt@
2015-09-10When loading a DSA key from an raw (without DH parameters) ASN.1 serialization,miod2-4/+96
perform some consistency checks on its `p' and `q' values, and return an error if the checks failed. Thanks for Georgi Guninski (guninski at guninski dot com) for mentioning the possibility of a weak (non prime) q value and providing a test case. See https://cpunks.org/pipermail/cypherpunks/2015-September/009007.html for a longer discussion. ok bcook@ beck@
2015-09-10delete empty SYNOPSIS sectionschwarze2-6/+4
2015-09-10Remove support for DTLS_BAD_VER. We do not support non-standard andjsing20-98/+46
incomplete implementations just so that we can interoperate with products from vendors who have not bothered to fix things in the last ~10 years. ok bcook@ miod@
2015-09-10improve examples,deraadt1-8/+11
1. hoist pollfd fields which don't change upwards 2. show ret as ssize_t, it MUST BE, or there will be lots of crying 3. on first pass, must check for either POLLIN|POLLOUT ok millert beck
2015-09-10Remove call to CRYPTO_malloc_init(), which does nothing.jsing1-2/+1
2015-09-10Put OPENSSL_cleanse under #ifndef LIBRESSL_INTERNAL.jsing2-2/+8
2015-09-10CRYPTO_set_mem_debug_functions() and CRYPTO_set_mem_functions() are alreadyjsing2-36/+6
noops, so neuter the CRYPTO_malloc_init and CRYPTO_malloc_debug_init macros. With input from miod@ ok beck@ bcook@ miod@
2015-09-10Correct spelling of OPENSSL_cleanse.jsing6-17/+17
2015-09-10Correct spelling of OPENSSL_cleanse.jsing139-399/+423
ok miod@
2015-09-10document client side certificate verification functionality.beck2-3/+19
ok jsing@
2015-09-10reduce .Nd to one line and kill .Tn while hereschwarze5-25/+15
2015-09-10Remove pointless comments.jsing6-12/+12
ok "captain obvious"
2015-09-10document changed tls_read and tls_write semantics.beck1-15/+58
document functions that clear errno. change examples to provide demonstration of both the blocking and non-blocking cases. ok jsing@, bluhm@
2015-09-10Replace remaining M_ASN1_STRING_* macros with calls to ASN1_STRING_*.jsing6-36/+36
This is not the same as the macro expansion, however the ASN1_STRING_* functions do match the macro expansions. ok doug@ miod@
2015-09-10mlink tls_handshake;jmc1-1/+2
2015-09-10tweak previous;jmc1-3/+3
2015-09-10missing commas at the end of .Nm lines in the NAME sectionschwarze1-3/+3
2015-09-10Correctly document the behaviour of tls_close() - the caller is responsiblejsing1-5/+6
for closing the file descriptors unless libtls allocated them. ok beck@
2015-09-10Replace TLS_{READ,WRITE}_AGAIN with TLS_WANT_POLL{IN,OUT} and correctlyjsing1-20/+13
document the calling requirements. ok beck@
2015-09-10Update libtls man page to reflect tls_handshake() related changes.jsing1-35/+37
ok beck@
2015-09-10revert accidental commitbeck1-4/+4
2015-09-10comment for errno clobbering, to indicate why we do this.beck2-5/+9
ok deraadt@ jsing@
2015-09-10bump majorbeck1-1/+1
ok jsing@
2015-09-10change TLS_READ_AGAIN to TLS_WANT_POLLIN and TLS_WRITE_AGAIN to TLS_WANT_POLLOUTbeck2-7/+7
to make it more clear to users of this api what needs to be done in these error cases. Discussed extensively with bluhm@ and jsing@ and others. ok jsing@
2015-09-10Change tls_read and tls_write semantics to return an ssize_t to betterbeck2-21/+14
match read() and write() semantics to make porting existing code using read/write easier.. requested by bluhm@ who convinced jsing and I to break the api ok jsing@ bluhm@
2015-09-10Split tls_handshake() out from tls_accept/tls_connect. By doing this thejsing5-59/+120
tls_accept/tls_connect functions can be guaranteed to succeed or fail and will no longer return TLS_READ_AGAIN/TLS_WRITE_AGAIN. This also resolves the semantics of tls_accept_*. The tls_handshake() function now does I/O and can return TLS_READ_AGAIN/TLS_WRITE_AGAIN. Calls to tls_read() and tls_write() will trigger the handshake if it has not already completed, meaning that in many cases existing code will continue to work. Discussed over many coffees at l2k15. ok beck@ bluhm@
2015-09-10tweak Nd after previous; ok mpijmc1-2/+2
2015-09-10add MLINKS for _prefer_ciphers_*jmc1-1/+3
2015-09-10Add support for preferring the server's cipher list or the client's cipherjsing5-8/+47
list. Prefer the server's cipher list by default. Based on a diff from Kyle Thompson <jmp at giga dot moe>. ok beck@ bcook@
2015-09-10Remove link_addr(3). A function to encode the name of an interface inmpi3-136/+8
a sockaddr_dl is a questionnable interface. But now it makes it harder to properly reference ifp becauses of this. Set sdl_index to the index of the corresponding interface when constructing a routing message. Ridding previous libc crank. ok guenther@, deraadt@, dlg@
2015-09-10Fix an incorrect error check in DSA verify.bcook2-8/+4
From Matt Caswell's OpenSSL commit "RT3192: spurious error in DSA verify". https://github.com/openssl/openssl/commit/eb63bce040d1cc6147d256f516b59552c018e29b
2015-09-10Fix shadowed verify_error in s_server by removing the unused global.bcook4-10/+8
's_time -verify 1' will now actually verify the peer certificate. ok beck@
2015-09-10Remove SOCKET_PROTOCOL, a redundant define that was only used once.lteo1-4/+2
No binary change. ok millert@ miod@
2015-09-10Remove unused defines. No binary change.lteo2-9/+2
ok deraadt@ miod@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-04 00:23:14 +0000