summaryrefslogtreecommitdiff
path: root/src (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-02-06Remove manual shutdown and close of the socket since in this casetb1-7/+1
SSL_free will do this a second time. ok jsing
2018-02-06Respect the OPENSSL make variable everywhere so thattb7-20/+22
make OPENSSL=/usr/src/usr.bin/openssl/obj/openssl actually does the expected thing instead of running a mixture of both the openssl below /usr/obj and the one below /usr/bin. Found the hard way via backtraces that made no sense whatsoever. ok jsing
2018-02-05Do not bother NULLing pointers in memory that is freed immediately after.jsing1-3/+1
2018-02-05Be consistent with the goto label names used in libtls code.jsing4-51/+52
No change to generated assembly.
2018-01-30keep in sync with ld.so malloc.cotto1-2/+3
2018-01-30word fix; from edgar pettijohnjmc1-3/+3
2018-01-28typootto1-2/+2
2018-01-28add malloc_threaderrotto1-1/+2
2018-01-28- An error in the multithreaded case could print the wrong function nameotto1-12/+23
- Start with a full page of struct region_info's - Save an mprotect in the init code: allocate 3 pages with none and make the middle page r/w instead of a r/w allocation and two calls to make the guard pages none
2018-01-28Test for correct error when on thread allocates, and another does a double freeotto2-0/+71
2018-01-28Initialize variables to avoid compiler warningsinoguchi3-6/+6
ok jsing@
2018-01-27Update regress to match removal of ssl_parse_clienthello_tlsext().jsing1-5/+8
2018-01-27Complete the TLS extension handling rewrite for the server-side.jsing5-98/+86
This removes ssl_parse_clienthello_tlsext() and allows the CBS to be passed all the way through from ssl3_get_client_hello(). The renegotation check gets pulled up into ssl3_get_client_hello() which is where other such checks exist. The TLS extension parsing now also ensures that we do not get duplicates of any known extensions (the old pre-rewrite code only did this for some extensions). ok inoguchi@
2018-01-27Clarify the comment re the F5 EC curves extension bug.jsing1-5/+6
Also reference the knowledge base article instead of a discussion thread.
2018-01-27Convert ssl3_put_cipher_by_char() to CBB.jsing1-9/+26
While here make the CBS usage in ssl3_get_cipher_by_char() more consistent with other code. ok inoguchi@
2018-01-26- do not junk pages returned by free_bytes(), all freed chunks are alreadyotto1-19/+19
junked - freezero(): only clear requested size
2018-01-24Make the NEON codepaths conditional on __STRICT_ALIGNMENT not beingkettenis3-5/+5
defined as they rely on unaligned access. ok joel@
2018-01-18Zap the rotor, it was a wrong idea. Cluebat applied by kshe whootto1-6/+3
came also up with this diff. Simple, no bias and benchmarks show the extra random calls disappear in te measurement noise.
2018-01-18Move to ffs(3) for bitmask scanning. I played with this earlier,otto1-21/+11
but at that time ffs function calls were generated instead of the compiler inlining the code. Now that ffs is marked protected in libc this is handled better. Thanks to kshe who prompted me to look at this again.
2018-01-18Instead of trying to handle ffs() with the normal rename-mark-hidden-and-aliasguenther2-4/+6
dance, mark it protected. This works better for both gcc and clang: gcc blocks overriding of internal calls, while clang permits inlining again. ok otto@
2018-01-15Add s_server and s_client -tlsextdebug messagesinoguchi1-1/+9
ok sthen@ jsing@
2018-01-12Adjust references for sysctl(3) to sysctl(2)deraadt1-4/+4
2018-01-08optimization and some cleanup; mostly from kshe (except the unmap() part)otto1-67/+51
2018-01-07On OpenBSD/armv7 we deliberately trap unaligned access. Unfortunatelykettenis5-12/+16
the assembly code in libcrypto assumes unaligned access is allowed for ARMv7. Make these paths conditional on __STRICT_ALIGNMENT not being defined and define __STRICT_ALIGNMENT in arm_arch.h for OpenBSD. ok tom@
2018-01-07Remove unused extern variable in openssl(1) s_timeinoguchi1-2/+1
This extern variable appears not to be used. And it is overridden by local variable in doConnection(). This causes MSVC warning C4459 "declaration of 'verify_error' hides global declaration". OK millert@
2018-01-01Only init chunk_info once, plus some moving of code to group related functions.otto1-273/+267
2017-12-28Initialise new_cipher in the serverhello TLS extensions test, to avoid ajsing1-3/+14
NULL pointer dereference in ssl_using_ecc_cipher(). Some compilers avoid triggering this, likely due to the EC formats list also being NULL. While here, setup the EC formats list so that we actually include the EC points format extension in the server hello extensions. Found the hard way by bcook@
2017-12-27step one in avoiding unneccesary init of chunk_info;otto1-65/+81
some cleanup; tested by sthen@ on a ports build
2017-12-24Fix one possible buffer overflow and one underflow. Also some minormillert1-20/+36
cleanups. From Jan Kokemueller. OK deraadt@
2017-12-16Move __cxa_thread_atexit* to its own .c file to avoid pulling the codeguenther4-39/+64
(w/ _dlctl reference) into static executables. It's all Mark's code so put his preferred copyright on it. ok kettenis@
2017-12-11bump to 2.7.0bcook1-3/+3
2017-12-11http://repzret.org/p/repzret/deraadt3-8/+8
My read of this: Long time ago (Think Conan, not dinasaurs) during the race to make speedier processors, a cpu vendor built a pipeline with a bad stall, and proposed a tremendously hasky workaround. A wizard adopted this into his perl scroll, and failed to reflect later when no compiler adopted the practice. This relic remains at the tail end of some functions in OpenSSL as ".byte 0xf3,0xc3". Banish it straight to hell. ok mlarkin, others also stared blankly
2017-12-09Make tls_config_parse_protocols() work correctly when passed a NULL pointerjsing1-3/+5
for a protocol string. Issue found by semarie@, who also provided the diff.
2017-12-09Add a regress test for tls_config_parse_protocols().jsing3-1/+183
2017-12-09Use a test value that fits into a long on both 32-bit and 64-bitjsing1-9/+11
architectures, so that the regress passes on both.
2017-12-09In the middle of CRYPTO_gcm128_finish() there is a complicated #ifdefderaadt1-6/+8
block which defines a variable late, after code. Place this chunk into a { subblock } to satisfy old compilers and old eyes.
2017-12-09Please variable decl before code.deraadt1-2/+2
2017-12-05Remove DEF_STRONG(__cxa_thread_atexit_impl). This produces an unwantedkettenis1-2/+1
_libc___cxa_thread_atexit_impl reference on gcc architectures that breaks the build.
2017-12-05Seperate real and user timer interfacesjca4-17/+15
Use more descriptive names, and make it clearer that real and user timers work on different static storage. The end goal is to be able to reuse those timer functions, instead of inlining other timer implementations subject to clock jumps. Discussed with Scott Cheloha
2017-12-05Implement __cxa_thread_atexit to support C++11 thread_local scope. Thekettenis3-3/+58
interface is also made available as __cxa_thread_atexit_impl to satisfy the needs of GNU libstdc++. ok guenther@, millert@
2017-12-01Avoid using an uninitialized variable.visa1-4/+6
Found by gcc. OK jca@
2017-11-29Mixing -url with any of -host, -port, or -path should be a usage errorguenther1-7/+8
instead of trying to work and then triggering a double-free(). problem noted by trondd (trondd (at) kagu-tsuchi.com) ok beck@
2017-11-29add -i to SYNOPSIS/usage() and sundry tweaks;jmc2-6/+8
ok beck
2017-11-29clang doesn't propagate attributes like "asm labels" and "visibility(hidden)"guenther4-11/+23
to builtins like mem{set,cpy,move} and __stack_smash_handler. So, when building with clang, instead mark those as protected visibility to get rid of the PLT relocations. We can't take the address of them then, but that's ok: it's a build-time error not a run-time error. ok kettenis@
2017-11-28Add option -i to allow oscpcheck to be used to validate an on-disk staplebeck2-49/+103
ok claudio@ benno@
2017-11-28Add the missing STANDARDS section (kettenis@ noticed that these areschwarze1-6/+14
POSIX functions) and turn the weird DIAGNOSTICS section into a normal RETURN VALUES section while here.
2017-11-28Allow TLS ciphers and protocols to be specified for nc(1).jsing2-41/+65
Replace the "tlscompat" and "tlsall" options with "cipher" and "protocol" options that are key/value pairs. This allows the user to specify ciphers and protocols in a form that are accepted by tls_config_set_ciphers() and tls_config_set_protocols() respectively. ok beck@ (also ok jmc@ for a previous revision of the man page).
2017-11-28Rewrite ASN1_TYPE_{get,set}_octetstring() using templated ASN.1.jsing1-81/+78
This removes the last remaining use of the old M_ASN1_* macros (asn1_mac.h) from API that needs to continue to exist. ok beck@ inoguchi@
2017-11-28Add regress coverage for ASN1_TYPE_{get,set}_int_octetstring()jsing2-2/+147
2017-11-28Correct TLS extensions handling when no extensions are present.jsing1-1/+13
If no TLS extensions are present in a client hello or server hello, omit the entire extensions block, rather than including it with a length of zero. ok beck@ inoguchi@
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-13 06:20:59 +0000