| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
| |
|
| |
|
|
|
|
|
|
| |
passphrase section a little; move the DER|PEM stuff in there to help
avoid text repetition, and prefer the lowercase (less keys to press);
adjust ENVIRONMENT to format a little more nicely;
|
|
|
|
| |
and move any relevant text into the main body;
|
|
|
|
|
|
| |
- rearrange the descriptions of -V and -v to read more logically
- move the cipherlist text into the cipherlist description
- zap examples
|
|
|
|
|
| |
move some other sections into more relevant places, and remove the example
ca file;
|
| |
|
| |
|
|
|
|
| |
ok tedu@
|
|
|
|
| |
ok beck@
|
|
|
|
| |
description of -out altered on jsing's advice
|
|
|
|
|
|
| |
- Return on first failure rather than continuing.
- Don't compare times by comparing strings that possibly were not parsable as a time.
ok deraadt@
|
|
|
|
|
|
|
|
| |
right to try and trim some of the excess from this page. begin now
by cutting some of the fluff from the start.
the section on pass phrase arguments goes to the end of the page: it;s in
the way for now.
|
|
|
|
|
| |
used if TLS 1.0 is enabled. Sugessted/discussed with jsing@ and bcook@.
ok guenther@ sthen@
|
|
|
|
|
|
|
| |
changes - map the previous configuration to the equivalent in the new
groups. This will be revisited post release.
Discussed with beck@
|
|
|
|
|
|
|
|
|
|
|
|
| |
"secure" (TLSv1.2+AEAD+PFS)
"compat" (HIGH:!aNULL)
"legacy" (HIGH:MEDIUM:!aNULL)
"insecure" (ALL:!aNULL:!eNULL)
This allows for flexibility and finer grained control, rather than having
two extremes (an issue raised by Marko Kreen some time ago).
ok beck@ tedu@
|
| |
|
|
|
|
| |
ok beck
|
| |
|
| |
|
|
|
|
| |
from Kinichiro Inoguchi
|
|
|
|
| |
ok beck@
|
|
|
|
|
| |
with a little help from jmc@ for the man page bits
ok jca@ and a reluctant tedu@
|
|
|
|
|
|
| |
at least one matching cipher suite.
ok doug@
|
|
|
|
|
| |
pledge to match. Also use tls_config_error() to provide friendlier error
messages.
|
|
|
|
|
|
|
|
|
|
| |
function is called. This simplifies code and results in a single memory
based code path being used to provide data to libssl. Errors that occur
when accessing the specified file are now detected and propagated
immediately. Since the file access now occurs when the configuration
function is called, we now play nicely with privsep/pledge.
ok beck@ bluhm@ doug@
|
|
|
|
|
|
| |
Reported by Vasily Kolobkov, based on a diff from Marko Kreen.
ok beck@
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
BN_mod_word() can return incorrect results if the supplied modulus is
too big, so we need to fall back to BN_div_word.
Now that BN_mod_word may fail, handle errors properly update the man page.
Thanks to Brian Smith for pointing out these fixes from BoringSSL:
https://boringssl.googlesource.com/boringssl/+/67cb49d045f04973ddba0f92fe8a8ad483c7da89
https://boringssl.googlesource.com/boringssl/+/44bedc348d9491e63c7ed1438db100a4b8a830be
ok beck@
|
|
|
|
|
|
| |
certificates provided in the response. - makes our newly added
ocsp regress test pass too..
ok bcook@
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
This makes error messages more specific and simplifies
masking compatible sections for the portable version.
ok beck@
|
|
|
|
|
|
|
|
|
|
| |
implementations.
In the event of a failure in _rs_allocate for rsx, we still have a reference to
freed memory for rs on return. Not a huge deal since we subsequently abort in
_rs_init, but it looks strange on its own.
ok deraadt@
|
|
|
|
|
|
|
|
|
|
|
|
| |
For Windows, we are simply using calloc, which has two annoyances:
the memory has more permissions than needed by default, and it comes
from the process heap, which looks like a memory leak since this memory
is rightfully never freed.
This switches _rs_alloc on Windows to use VirtualAlloc, which restricts the
memory to READ|WRITE and keeps the memory out of the process heap.
ok deraadt@
|
| |
|
|
|
|
| |
chunk rnd), rm P: is default
|
|
|
|
|
|
|
|
| |
This removes support for DSA_FLAG_NO_EXP_CONSTTIME, DH_FLAG_NO_EXP_CONSTTIME,
and RSA_FLAG_NO_CONSTTIME flags, making all of these operations unconditionally
constant-time.
Based on the original patch by César Pereid. ok beck@
|
|
|
|
| |
Req by and ok blumh@
|
|
|
|
|
|
| |
double unmap and I experienced a much more unstable firefox.
discussed with otto on icb
|
|
|
|
|
| |
is shown by errx
ok millert krw
|
|
|
|
|
| |
so complicated that a future refactoring could easily in introduce a bug.
ok millert krw
|
|
|
|
|
|
|
| |
expensive syscall, and we don't want to tie up other threads. there's no
need to hold the lock, so defer it to afterwards.
from Michael McConville
ok deraadt
|
| |
|
|
|
|
| |
for login.conf, and we don't want to go lower.
|
|
|
|
| |
Generalized Time on requests as per RFC6960
|
|
|
|
|
|
|
|
|
| |
which was not being done due to a lack of checking of the return code for
X509_cmp_time. Ensure that we only compare GERNERALIZEDTIME values because
this is what is specified by RFC6960.
Issue reported, and fix provided by Kazuki Yamaguchi <k@rhe.jp>
ok bcook@
|