| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | use freezero() instead of memset/explicit_bzero + free. Substantially | deraadt | 2017-05-02 | 38 | -238/+109 | |
| | | | | | | | | | | | reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck | |||||
| * | No original OpenSSL code remains in this file. Relicense | beck | 2017-04-30 | 1 | -54/+13 | |
| | | ||||||
| * | whitespace | beck | 2017-04-30 | 1 | -3/+3 | |
| | | ||||||
| * | Make BIO_get_host_ip just yet another getaddrinfo wrapper | beck | 2017-04-30 | 1 | -27/+20 | |
| | | ||||||
| * | Rework BIO_accept to be more like modern code. | beck | 2017-04-30 | 1 | -54/+19 | |
| | | | | | ok jsing@ | |||||
| * | Only enable -Werror on libcrypto/libssl/libtls if we are building with | jsing | 2017-04-30 | 3 | -7/+14 | |
| | | | | | | | | gcc4. This should avoid failed builds while transitioning compilers. While here also make the CFLAGS blocks consistent across makefiles. Discussed with deraadt@, ok beck@ | |||||
| * | Switch back to freezero() and explicitly initialise data_len to zero. The | jsing | 2017-04-30 | 1 | -6/+3 | |
| | | | | | | previous code was safe since data would always be NULL if data_len was uninitialised, however compilers cannot know this. | |||||
| * | Microsoft Windows hates BIO_get_accept_socket in portable. Fix it to | beck | 2017-04-30 | 1 | -115/+35 | |
| | | | | | | | not be awful or have any claims on supporting ipv6 when it does so very badly ok jsing@ | |||||
| * | Add missing tls_init() and tls_free() calls. | jsing | 2017-04-30 | 1 | -1/+4 | |
| | | ||||||
| * | Add a tls_keypair_clear_key() function that uses freezero() to make key | jsing | 2017-04-30 | 1 | -5/+11 | |
| | | | | | | | material inaccessible, then call it from the appropriate places. ok beck@ | |||||
| * | Fix a bug caused by the return value being set early to signal successful | jsing | 2017-04-29 | 1 | -5/+5 | |
| | | | | | | | | | | | | | | | | DTLS cookie validation. This can mask a later failure and result in a positive return value being returned from ssl3_get_client_hello(), when it should return a negative value to propagate the error. Ironically this was introduced in OpenSSL 2e9802b7a7b with the commit message "Fix DTLS cookie management bugs". Fix based on OpenSSL. Issue reported by Nicolas Bouliane <nbouliane at jive dot com>. ok beck@ | |||||
| * | Revert previous - we still want to do this, but I forgot about the installer | beck | 2017-04-29 | 2 | -14/+6 | |
| | | | | | | and want to avoid the wrath of theo when he arrives home in a couple of hours :) | |||||
| * | We now require you to have a working libpthread | beck | 2017-04-29 | 1 | -1/+2 | |
| | | ||||||
| * | Make it safe to call SSL_library_init more than once. | beck | 2017-04-29 | 1 | -5/+12 | |
| | | | | | | | We are basically admitting that pthread is everywhere, and we will be using it for other things too. ok jsing@ | |||||
| * | Stop calling OPENSSL_init() internally, since it is a no-op. Also place | jsing | 2017-04-29 | 3 | -9/+4 | |
| | | | | | | | it under #ifndef LIBRESSL_INTERNAL. ok beck@ | |||||
| * | Switch Linux getrandom() usage to non-blocking mode, continuing to | beck | 2017-04-29 | 1 | -6/+9 | |
| | | | | | | | | | | | use fallback mechanims if unsuccessful. The design of Linux getrandom is broken. It has an uninitialized phase coupled with blocking behaviour, which is unacceptable from within a library at boot time without possible recovery. ok deraadt@ jsing@ | |||||
| * | Revert previous change that forced consistency between return value and | beck | 2017-04-28 | 1 | -10/+2 | |
| | | | | | | | | error code, since this breaks the documented API. Under certain circumstances this will result in incorrect successful certiticate verification (where a user supplied callback always returns 1, and later code checks the error code to potentially abort post verification) | |||||
| * | revert previous accidental commit | beck | 2017-04-28 | 5 | -25/+46 | |
| | | ||||||
| * | *** empty log message *** | beck | 2017-04-28 | 5 | -46/+25 | |
| | | ||||||
| * | Remove "len < 0" check; len is socklen_t (uint32_t) so can't be | millert | 2017-04-27 | 1 | -2/+2 | |
| | | | | | negative. Quiets a warning from clang. OK bluhm@ | |||||
| * | tls_free(3) and tls_config_free(3) accept NULL; | schwarze | 2017-04-27 | 2 | -4/+14 | |
| | | | | | | patch from Matthew Martin <phy1729 at gmail dot com>, slightly tweaked by me | |||||
| * | Rearrange text a bit to make it clear what "discarded" means; ok jmc@ deraadt@ | otto | 2017-04-23 | 1 | -8/+13 | |
| | | ||||||
| * | For small allocations (chunk) freezero only validates the given | otto | 2017-04-22 | 1 | -5/+10 | |
| | | | | | | | | | size if canaries are enabled. In that case we have the exact requested size of the allocation. But we can at least check the given size against the chunk size if C is not enabled. Plus add some braces so my brain doesn't have to scan for dangling else problems when I see this code. | |||||
| * | Fix previous. | visa | 2017-04-20 | 1 | -2/+2 | |
| | | ||||||
| * | Get TCB address using the RDHWR instruction instead of __get_tcb(). | visa | 2017-04-20 | 1 | -4/+5 | |
| | | | | | | | | | | | | This gives fast access to the address on systems that implement the UserLocal register. TCB caching is still used when running in the single-threaded mode in order not to penalize old systems. The kernel counterpart of this change must be in place before using this diff! With guenther@ | |||||
| * | don't forget to fill in canary bytes for posix_memalign(3); reported by | otto | 2017-04-18 | 1 | -1/+4 | |
| | | | | | and ok jeremy@ | |||||
| * | use freezero() instead of 4-line conditional explicit_bzero + free | deraadt | 2017-04-18 | 4 | -28/+10 | |
| | | ||||||
| * | consictently use .Dv NULL and a few other tweaks; ok schwarze@ | otto | 2017-04-17 | 1 | -20/+17 | |
| | | ||||||
| * | whitespace fixes | otto | 2017-04-17 | 1 | -14/+14 | |
| | | ||||||
| * | Use INT_MAX instead of SIZE_MAX as the maximum file size we can handle. | kettenis | 2017-04-16 | 1 | -2/+2 | |
| | | | | | | | Fixes this test on 64-bit architectures. ok visa@ | |||||
| * | Define DEF_WEAK like we do for ld.so to fix building this with clang. | kettenis | 2017-04-16 | 1 | -1/+2 | |
| | | | | | ok millert@, deraadt@ | |||||
| * | Move comments into a block and uses {} to unconfuse reading. | deraadt | 2017-04-16 | 1 | -12/+13 | |
| | | ||||||
| * | Use %zu to print a size_t. | kettenis | 2017-04-16 | 1 | -2/+2 | |
| | | ||||||
| * | Remove unused rnd_seed variable. Upstream made the same change 4 days ago. | kettenis | 2017-04-16 | 1 | -3/+0 | |
| | | | | | Fixes compiling this test using clang on arm64. | |||||
| * | backout previous, data_len is not always initialized | otto | 2017-04-16 | 1 | -2/+5 | |
| | | ||||||
| * | Use freezero(3) when cleaning up session tickets - not only does it require | jsing | 2017-04-14 | 1 | -6/+3 | |
| | | | | | | less code, but there is also a potential performance gain since they can be larger allocations. | |||||
| * | Use freezero(3) to clean up the X25519 keys - simpler, cleaner code. | jsing | 2017-04-14 | 1 | -6/+3 | |
| | | ||||||
| * | Use freezero(3) in the CBB clean up path, since this could hold sensitive | jsing | 2017-04-14 | 1 | -3/+2 | |
| | | | | | information (such as master keys). | |||||
| * | Switch i2d_SSL_SESSION() back to freezero(3) now that the size constraints | jsing | 2017-04-14 | 1 | -5/+2 | |
| | | | | | have been relaxed. | |||||
| * | Clean up server key exchange EC point handling. Encode the point directly | jsing | 2017-04-14 | 1 | -27/+15 | |
| | | | | | | | | | into the CBB memory, rather than mallocing and memcpying, which also makes makes the code more consistent with the client. Add a missing check for the first EC_POINT_point2oct() call. ok beck@ | |||||
| * | allow clearing less than allocated and document freezero(3) better | otto | 2017-04-13 | 2 | -13/+26 | |
| | | ||||||
| * | New strstr() implementation from musl libc by Rich Felker. This | millert | 2017-04-12 | 1 | -44/+180 | |
| | | | | | | | | | version uses the two-way string matching algorithm and is faster than the old implementation. With this change, ports that check for strstr having linear complexity time strstr will no longer replace the libc strstr with a private version. OK deraadt@ espie@ | |||||
| * | Revert ssl_asn1.c r1.50 - CBB and freezero(3) do not play nicely together. | jsing | 2017-04-11 | 1 | -2/+5 | |
| | | | | | | | Back this out while we investigate and implement a solution. Found the hard way by sthen@ | |||||
| * | new X25519(3) manual page; | schwarze | 2017-04-10 | 5 | -10/+113 | |
| | | | | | from Dr. Stephen Henson <steve@openssl.org>, OpenSSL commit d218f3c3 | |||||
| * | Use freezero() for the internal opaque structures, instead of the current | jsing | 2017-04-10 | 3 | -18/+9 | |
| | | | | | explicit_bzero()/free(). Less code and potentially less overhead. | |||||
| * | Use freezero() for X25519 keys - same result with more readable code. | jsing | 2017-04-10 | 1 | -7/+3 | |
| | | ||||||
| * | document three additional functions; | schwarze | 2017-04-10 | 1 | -7/+60 | |
| | | | | | from Emilia Kasper <emilia at openssl dot org>, OpenSSL commit 4ac139b4 | |||||
| * | Rework and significantly extend TLS name verification tests to match | jsing | 2017-04-10 | 1 | -99/+377 | |
| | | | | | changes in libtls. | |||||
| * | Rework name verification code so that a match is indicated via an argument, | jsing | 2017-04-10 | 5 | -47/+76 | |
| | | | | | | | | | | | rather than return codes. More strictly follow RFC 6125, in particular only check the CN if there are no SAN identifiers present in the certificate (per section 6.4.4). Previous behaviour questioned by Daniel Stenberg <daniel at haxx dot se>. ok beck@ jca@ | |||||
| * | freezero() the key block; simpler code and less of it. | jsing | 2017-04-10 | 1 | -7/+3 | |
| | | ||||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |