summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Bump for LibreSSL 2.3.10libressl-v2.3.10OPENBSD_5_9bcook2017-01-071-3/+3
|
* MFC: Avoid a side-channel cache-timing attack that can leak the ECDSAjsing2017-01-051-1/+3
| | | | | | | | | private keys when signing. This is due to BN_mod_inverse() being used without the constant time flag being set. This issue was reported by Cesar Pereida Garcia and Billy Brumley (Tampere University of Technology). The fix was developed by Cesar Pereida Garcia.
* MFC: In ssl3_read_bytes(), do not process more than three consecutive TLSlibressl-v2.3.9jsing2016-11-031-4/+24
| | | | | | | | records, otherwise a peer can potentially cause us to loop indefinately. Return with an SSL_ERROR_WANT_READ instead, so that the caller can choose when they want to handle further processing for this connection. ok beck@ miod@
* bump to 2.3.9bcook2016-10-021-3/+3
|
* MFC: Avoid falling back to a weak digest for (EC)DH when using SNI withlibressl-v2.3.8jsing2016-09-221-3/+10
| | | | libssl.
* MFC: Avoid unbounded memory growth in libssl, which can be triggered by ajsing2016-09-221-9/+20
| | | | | TLS client repeatedly renegotiating and sending OCSP Status Request TLS extensions.
* bump version for 2.3.8bcook2016-09-221-3/+3
|
* bump for 2.3.7libressl-v2.3.7bcook2016-06-301-3/+3
|
* Fix several issues in the OCSP code that could result in the incorrectbeck2016-06-252-9/+33
| | | | | | | | | generation and parsing of OCSP requests. This remediates a lack of error checking on time parsing in these functions, and ensures that only GENERALIZEDTIME formats are accepted for OCSP, as per RFC 6960 Issues reported, and fixes provided by Kazuki Yamaguchi <k@rhe.jp> and Kinichiro Inoguchi <kinichiro.inoguchi@gmail.com>
* Set BN_FLG_CONSTTIME on the correct variable. beck committed wrong fix.libressl-v2.3.6tedu2016-06-061-2/+2
| | | | Mistake noted by Billy Brumley. Many thanks.
* Correct a problem that prevents the DSA signing algorithm from runningbeck2016-06-061-4/+6
| | | | | | | in constant time even if the flag BN_FLG_CONSTTIME is set. This issue was reported by Cesar Pereida (Aalto University), Billy Brumley (Tampere University of Technology), and Yuval Yarom (The University of Adelaide and NICTA). The fix was developed by Cesar Pereida
* LibreSSL 2.3.6bcook2016-06-061-3/+3
|
* bump to 2.3.5libressl-v2.3.5bcook2016-05-291-3/+3
|
* Fix a short-read bug in the previous version of asn1_d2i_read_biobcook2016-05-291-26/+28
| | | | | The outer while() loop is missing, so we only read up to chunk_max bytes. ok tedu
* this chunk was NOT supposed to be committed. spotted by jsg.tedu2016-05-041-2/+1
|
* prefer limits.h over sys/limits.hlibressl-v2.3.4bcook2016-05-031-2/+2
|
* bump to 2.3.4bcook2016-05-031-2/+2
|
* backport patch from openssl for multiple issues:tedu2016-05-038-31/+58
| | | | | | | missing padding check in aesni functions overflow in evp encode functions use of invalid negative asn.1 types ok beck
* This commit was manufactured by cvs2git to create branch 'OPENBSD_5_9'.cvs2svn2016-05-031-0/+209
|
* bump for LibreSSL 2.3.3libressl-v2.3.3bcook2016-03-121-3/+3
|
* This commit was manufactured by cvs2git to create branch 'OPENBSD_5_9'.cvs2svn2016-02-171186-380326/+0
|
* Sync some root certificates with Mozilla's cert store. ok bcook@sthen2016-02-171-84/+1016
| | | | | | | | | | | | | | | | | | | - Add new root certificates present in Mozilla cert store from CA organizations who are already in cert.pem (AddTrust, Comodo, DigiCert, Entrust, GeoTrust, USERTrust). - Replace Startcom's root with their updated sha256 version present in Mozilla cert store. (They maintained serial# etc so this is still valid for existing signed certificates). - Add two root certificates from CA not previously present: "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority" "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA" (the latter used by yandex.ru) We are still listing some certificates that have been removed from Mozilla's store (1024-bit etc) however these cannot be removed until cert validation is improved (we don't currently accept a certificate as valid unless the CA is at the end of a chain).
* word fix from previous; ok sthenjmc2016-02-121-3/+3
|
* sslv3 has been removed;jmc2016-02-081-16/+21
| | | | | prompted by a mail from jiri navratil help/ok sthen
* compare pointer to NULL in example codemmcc2016-02-071-3/+3
|
* be more forceful about not using these.espie2016-02-051-2/+9
| | | | improvements sthen@, jmc@. okay millert@, jca@ jmc@
* Fix err(3) calls after allocation failures in examples.schwarze2016-02-051-8/+8
| | | | | | There is long-standing consensus that err(1, NULL) is the best idiom after failure of malloc(3) and friends. Quirk in the manual noticed by tb@.
* Sort cert.pem alphabetically, first by organisation, then by CA namesthen2016-02-011-1604/+1584
| | | | | | | | | | | (CN if available, otherwise OU). Add a comment identifying the org. Now to get an easy-to-read list of certificates in the file you can use "grep ^[#=] cert.pem". Prepared with https://spacehopper.org/format-pem.20160201. If you would like to verify this commit to ensure that I didn't sneak in any other changes, it will be easier to use the script rather than do it by hand.
* Revamp cert.pem certificate information formatting. Skip headers whichsthen2016-01-311-2459/+184
| | | | | | | | | aren't really useful (the information can be obtained by feeding the cert into "openssl x509 -in filename -text") and add a separator between certs showing the CA's CN or OU (similar to the display format in web browsers). Include both SHA1 and SHA256 fingerprints for all certificates. ok beck@ zhuk@ jung@
* Therefor -> Therefore (where appropriate)tb2016-01-292-2/+2
| | | | from ray@, ok jmc@
* deprecate SSL_OP_SINGLE_DH_USElibressl-v2.3.2beck2016-01-274-74/+12
| | | | ok jsing@
* Don't crash dumping malloc stats if malloc_init hasn't been called, noted byotto2016-01-261-1/+3
| | | | David CARLIER
* Call BIO_sock_init() from tls_init() to ensure sockets are enabled on Windows.bcook2016-01-181-1/+4
| | | | This is of course a no-op on other platforms. Noted by equalsraf from github.
* Long ago, malloc internally had two kinds of failures, warnings and errors.tedu2016-01-062-14/+7
| | | | | | | | The 'A' option elevated warnings to errors, and has been the default for some time. Then warnings were effectively eliminated in favor of everything being an error, but then the 'a' flag turned real errors into warnings! Remove the 'a' option entirely. You shouldn't have used it anyway. ok tb tdeval
* Follow style(9) and drop lint /* NOTREACHED */ annotations fromtb2016-01-042-6/+4
| | | | | | | | the examples. Diff from Juuso Lapinlampi < wub () partyvan ! eu >, thanks! ok schwarze@
* Use the correct values for TLS certificate / private key flags.bcook2016-01-041-5/+5
| | | | fix from Andreas Bartelt <obsd at bartula.de>
* Calling clone(2) with CLONE_NEWPID yields multiple processes with pid=1.bcook2016-01-042-4/+6
| | | | | | | | | | | | | Work around this particular case by reseeding whenever pid=1, but as guenther@ notes, directly calling clone(2), and then forking to match another pid, provides other ways to bypass new process detection on Linux. Hopefully at some point Linux implements something like MAP_INHERIT_ZERO, and does not invent a corresponding mechanism to subvert it. Noted by Sebastian Krahmer and the opmsg team. See http://stealth.openwall.net/crypto/randup.c for a test program. ok beck@
* Document that the ssl free() functions are NULL safe. OK mmcc@millert2015-12-306-12/+42
|
* another case where bad things would happen after wrterrortedu2015-12-301-2/+4
|
* if somebody makes the mistake of disabling abort, don't deref null intedu2015-12-301-2/+4
| | | | validate_junk. from Michal Mazurek
* Remove NULL-checks before free() and a few related dead assignments.mmcc2015-12-282-8/+5
| | | | ok and valuable input from millert@
* initialize pointer to avoid undefined free on failurebcook2015-12-281-2/+2
| | | | ok beck@
* include time.h over sys/time.h for ctime(3)bcook2015-12-281-2/+2
| | | | ok beck@
* remove unused variablechl2015-12-271-2/+1
| | | | ok tedu@
* more e-mail -> emailmmcc2015-12-242-5/+5
|
* More adress -> addressmmcc2015-12-244-4/+4
|
* remove NULL-check before free()mmcc2015-12-231-3/+2
|
* remove NULL-checks before free()mmcc2015-12-236-38/+22
|
* assign pointer NULL rather than 0mmcc2015-12-232-4/+4
|
* assign pointer to NULL rather than 0mmcc2015-12-232-4/+4
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-16 12:27:19 +0000