summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Do not fail with obscure error messages on 'make'tb2020-10-293-6/+12
| | | | | | | | | | | Fix some tests that fail with obscure error messages on 'make' if the required package (either version of OpenSSL or Botan 2) isn't installed. This can be avoided by doing 'make regress' instead. I'll try to adjust my finger memory for the many tests outside the LibreSSL tree that have the same "problem". The fix here is unintrusive and I've been wasting enough time with this to want to change it. ok bluhm
* catch unset error when validation fails.beck2020-10-262-2/+16
|
* Add a safety net to ensure that we set an error on the store context.tb2020-10-261-1/+3
| | | | Suggested by and discussed with beck
* If x509_verify() fails, ensure that the error is also set on the storetb2020-10-261-10/+15
| | | | | | | context. This is what is returned in SSL_get_verify_result(). Spotted and initial diff from jeremy; discussed with jsing ok beck
* Make sure that x509_vfy_check_id() failure also sets ctx->error, not onlytb2020-10-261-3/+8
| | | | | | ctx->xsc->error. Will be needed in an upcoming diff. from beck
* Add a -legacy_verify flag to force use of the old validator for debuggingtb2020-10-263-4/+13
| | | | | | and testing purposes. ok beck inoguchi jsing
* Stop documenting some functions as macros.tb2020-10-213-19/+7
| | | | | | | In x509.h r1.70 (2018/08/24) I turned some macros into actual functions to follow what OpenSSL is doing since 1.1.0. The documentation still claims that they are implemented as macros. Update a doc sync commit hash while there.
* On machines with a userland timecounter we bypass the gettimeofday(2)kettenis2020-10-211-2/+16
| | | | | | | | syscall. So whenever we pass a bad address we get a SIGSEGV instead of EFAULT. POSIX explicitly allows this behaviour. So adjust the test to deal with this case. ok deraadt@, millert@, guenther@
* Skip floating-point exception checks on arm64 and armv7 as the hardwarekettenis2020-10-192-2/+6
| | | | | | (typically) doesn't implement support for these. ok patrick@, drahn@
* XFAIL tests on arm64 and armv7 as floating-point exception support iskettenis2020-10-181-1/+6
| | | | optional and isn't implemented on most hardware.
* make this test compile and pass on sparc64tb2020-10-161-2/+2
| | | | | Two functions missed (void) in their declaration which made gcc whine "warning: function declaration isn't a prototype".
* Add an explicit cast to make this test compile and pass with gcc.tb2020-10-161-2/+2
| | | | | gcc emits a signed vs unsigned comparison warning which breaks the build due to -Werror.
* Refactor a bunch of oscpcheck for single return to clean it up,beck2020-10-161-63/+95
| | | | | | | | | | | | and add the ability to parse a port in the specified ocsp url. Since this will now pass them, enable regress tests previously committed for ocspcheck. mostly by me with some cleanup by tb after an obvious yak was found to shave in the OCSP routines in libcrypto ok tb@
* Test DTLS timeouts and retransmissions by dropping specific messages.jsing2020-10-151-5/+299
| | | | | | | | | Provide a BIO that can drop specific messages in order to trigger and test DTLS timeouts and retransmissions. Note that the SSL buffering BIO (bbio) has to be removed to ensure that handshake messages are sent individually. This would have detected the recent DTLS breakage with retransmissions for a flight that includes a CCS.
* Unbreak DTLS retransmissions for flights that include a CCS.jsing2020-10-151-7/+8
| | | | | | | | | | When retransmitting a flight that includes a CCS, the record protection from the previous epoch has to be used to send the messages up to and including the CCS, with messages after the CCS using record protection from the current epoch. The code that restores the record protection state failed to work correctly with the new TLSv1.2 record layer. ok tb@
* Improve poll and event handling.jsing2020-10-151-8/+27
| | | | | In particular, ensure we clear events when the client or server side has completed and fix timeouts to ensure we use a non-zero timeout if present.
* zap annoying stray spacestb2020-10-151-4/+4
|
* Replace SSL_IS_DTLS with SSL_is_dtls().jsing2020-10-1411-96/+92
| | | | | | Garbage collect the now unused SSL_IS_DTLS macro. ok tb@
* Provide SSL_is_dtls().jsing2020-10-142-2/+11
| | | | | | | For now this is #ifdef LIBRESSL_INTERNAL and will be exposed during the next library bump. ok tb@
* Mark DTLS methods as DTLS.jsing2020-10-142-3/+10
| | | | | | | | Rather than inferring DTLS from the method version, add a field that marks a method as specifically being DTLS. Have SSL_IS_DTLS condition on this rather than on version. ok tb@
* Hook up dtls regress.jsing2020-10-141-1/+2
|
* Add regress tests for DTLS.jsing2020-10-142-0/+411
| | | | | | | | Test the operation of a DTLS client and server, with and without cookies, using the default MTU and a specifically lowered MTU. Further regress tests will be built on this to exercise other parts of the DTLS code base (such as retransmission, fragmentation and reassembly).
* no need to initialize i if it's re-initialized a few lines downtb2020-10-141-2/+1
|
* Free peekaboo pbuf at end of s_client_main()tb2020-10-141-1/+2
| | | | | | | Otherwise each run of the s_client leaks 16k of memory. This hurts in interactive mode. ok inoguchi jsing
* Make sure an OCSP query sends a host headertb2020-10-131-4/+13
| | | | | | | | | | | While OCSP uses HTTP/1.0 where a host header is optional, some widely used OCSP responders will return 400 bad request if it is missing. Add such a header unless it's already provided in the user's custom headers. OpenSSL did something similar in ff4a9394a23 and 76e0cd12f68 (both commits are under the old license) ok inoguchi
* make fixed-sized fixed-value mib[] arrays be constderaadt2020-10-123-12/+7
| | | | ok guenther tb millert
* avoid two overlong lines and drop an unused printf argumenttb2020-10-121-4/+4
|
* drop references to the SSL protocol because support was removed long ago;schwarze2020-10-121-6/+6
| | | | suggested by tb@
* List and describe the recommended methods first and relegate theschwarze2020-10-121-27/+26
| | | | | | deprecated methods to a separate table. Simplify and shorten the surrounding verbiage. Joint work with tb@.
* In ssl_methods.c rev. 1.18, jsing@ deprecated *_server_method(3)schwarze2020-10-111-11/+18
| | | | | | | and *_client_method(3). Adjust the documentation. While here, delete most of the verbiage regarding the deprecated functions SSLv23_*(3) and add the missing entry to RETURN VALUES. OK tb@
* SSL3_ENC_METHOD is just a flag word; merge it into SSL_METHOD_INTERNALguenther2020-10-115-42/+28
| | | | | | | with #defines for the per-version initializers instead of extern globals. Add SSL_USE_SHA256_PRF() to complete the abstraction. ok tb@ jsing@
* Fix an assert conditioned on DTLS1_VERSION.jsing2020-10-111-9/+4
| | | | | | | | This condition previously existed for DTLS BAD_VER, which has long been removed. Furthermore, conditioning on DTLS1_VERSION means this is broken for any newer DTLS version. While here roll up two assertions into one. ok tb@
* Grow init_buf before stashing a handshake message for the legacy stack.jsing2020-10-111-1/+3
| | | | | | | | | | | | | When transitioning from the TLSv1.3 stack to the legacy stack, grow init_buf before stashing the handshake message. The TLSv1.3 stack has already received the handshake message (potentially from multiple TLS records) and validated its size, however the default allocation is only for a single plaintext record, which can result in the handshake message failing to fit in certain cases. Issue noted by tb@ via tlsfuzzer. ok tb@
* No longer need to cast away const in srtp_find_profile_by_name()tb2020-10-111-2/+2
|
* Make profile_name const in srtp_find_profile_by_name()tb2020-10-112-7/+5
| | | | | | | | There is no reason (and there never was any) for profile_name to be non-const, it was always just passed to strncmp(). Changing this allows removing an ugly instance of casting away const. ok guenther jsing
* Update regress for method changes.jsing2020-10-111-4/+4
|
* Condense and simplify TLS methods.jsing2020-10-117-442/+73
| | | | | | | | | | | | | | | Historically, OpenSSL has had client and server specific methods - the only difference between these is that the .ssl_connect or .ssl_accept function pointer is set to ssl_undefined_function, with the intention of reducing code size for a statically linked binary that was only a client or server. These days the difference is minimal or non-existant in many cases and we can reduce the amount of code and complexity by having single method. Internally remove all of the client and server specific methods, simplifying code in the process. The external client/server specific API remain, however these now return the same thing as TLS_method() does. ok tb@
* Unbreak regress following SRTP_PROTECTION_PROFILE const change.jsing2020-10-111-2/+2
|
* Constipate srtp_known_profiles, pushing it into .data.rel.roguenther2020-10-113-17/+18
| | | | ok tb@ jsing@
* Constipate ssl3_ciphers and tls1[23]_sigalgs*, pushing them intoguenther2020-10-116-32/+32
| | | | | | .data.rel.ro and .rodata respectively. ok tb@ jsing@
* Don't leak bundle_file and cert_file paths at the end.tb2020-10-101-1/+3
|
* Fix leak or double free with OCSP_request_add0_id()tb2020-10-091-8/+9
| | | | | | | | | | | | | | | | | On success, OCSP_request_add0_id() transfers ownership of cid to either 'one' or 'req' depending on whether the latter is NULL or not. On failure, the caller can't tell whether OCSP_ONEREQ_new() failed (in which case cid needs to be freed) or whether it was a failure to allocate memory in sk_insert() (in which case cid must not be freed). The caller is thus faced with the choice of leaving either a leak or a potential double free. Fix this by transferring ownership only at the end of the function. Found while reviewing an upcoming diff by beck. ok jsing
* As noted by tb@ previous commit only removed an unused fucntion.otto2020-10-091-4/+9
| | | | | So redo previous commit properly: Use random value for canary bytes; ok tb@.
* set SO_REUSEADDR on the server socket when we play oscp server.beck2020-10-081-1/+2
| | | | ok inoguchi@ tb@ deraadt@
* A void function has no return value, so zap RETURN VALUES sectiontb2020-10-081-5/+2
| | | | | documenting that SSL_set_bio(3) cannot fail. A similar commit was made by schwarze a while ago for a few functions in libcrypto.
* grammar fix: if/when a renegotiation takeS placetb2020-10-082-6/+6
|
* Read cert.pem once and reuse it instead of reading it twice per test certtb2020-10-081-18/+10
| | | | | | | | chain. It only takes a few dozens of ms to read it, but doing this 7290 times adds up to a few minutes run time. This way, the test completes in a handful of seconds. Diagnosed by jsing, ok beck
* zap trailing whitespacetb2020-10-071-21/+21
|
* add arguments to skip a bunch of x448 teststb2020-10-071-3/+18
|
* fix line wrappingtb2020-10-071-3/+2
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-23 01:27:13 +0000