| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Treat "ERROR in STARTUP" as an actual error, rather than failing without | jsing | 2017-03-04 | 1 | -2/+2 |
| | | | | | | | | exiting non-zero (which has been masking a DTLS related issue). Also make the message consistent with other errors. Spotted by inogochi@ | ||||
| * | Remove commented out code and fix indentation of surrounding statements. | jsing | 2017-03-04 | 1 | -12/+5 |
| | | |||||
| * | Remove handling for SSLv2. | jsing | 2017-03-04 | 1 | -14/+3 |
| | | |||||
| * | Ensure MD and key initialized before processing HMAC | inoguchi | 2017-03-03 | 2 | -35/+224 |
| | | | | | | | | | Ensure both MD and key have been initialized before processing HMAC. Releasing HMAC_CTX in error path of HMAC(). In regress test, added test 4,5,6 and cleaned up the code. ok jsing@ | ||||
| * | fix error in Dt; from robert klein | jmc | 2017-03-02 | 1 | -3/+3 |
| | | |||||
| * | Convert ssl3_{get,send}_server_key_exchange() to EVP_md5_sha1(). | jsing | 2017-03-01 | 3 | -44/+29 |
| | | | | | ok inoguchi@ | ||||
| * | Add EVP test for MD5-SHA1. | jsing | 2017-03-01 | 1 | -0/+3 |
| | | |||||
| * | Include EVP_md5_sha1() via OpenSSL_add_all_digests(). | jsing | 2017-03-01 | 1 | -1/+2 |
| | | |||||
| * | Bump minors due to symbol addition. | jsing | 2017-02-28 | 3 | -3/+3 |
| | | |||||
| * | Document EVP_md5_sha1(). | jsing | 2017-02-28 | 1 | -2/+11 |
| | | |||||
| * | Add an EVP interface that provides concatenated MD5+SHA1 hashes, which are | jsing | 2017-02-28 | 4 | -2/+88 |
| | | | | | | | | | | | used in various parts of TLS 1.0/1.1. This will allow for code simplification in libssl. The same interface exists in OpenSSL 1.1. ok beck@ deraadt@ inoguchi@ millert@ | ||||
| * | Fix typo in issuingDistributionPoint description. | jsing | 2017-02-28 | 1 | -1/+1 |
| | | |||||
| * | Stop pretending that MD5 and SHA1 might not exist - rather than locating | jsing | 2017-02-28 | 4 | -20/+8 |
| | | | | | | | | "ssl3-md5" and "ssl-sha1", call the EVP_md5() and EVP_sha1() functions directly. ok beck@ inoguchi@ | ||||
| * | Add support for RES_USE_DNSSEC | jca | 2017-02-27 | 1 | -5/+2 |
| | | | | | | | | | | | | | RES_USE_DNSSEC is implemented by setting the DNSSEC DO bit in outgoing queries. The resolver is then supposed to set the AD bit in the reply if it managed to validate the answer through DNSSEC. Useful when the application doesn't implement validation internally. This scheme assumes that the validating resolver is trusted and that the communication channel between the validating resolver and and the client is secure. ok eric@ gilles@ | ||||
| * | pledge stdio before parsing the http response | beck | 2017-02-25 | 1 | -9/+11 |
| | | | | | ok tb@ | ||||
| * | Add missing includes to avoid implicit function declarations. | jsg | 2017-02-25 | 4 | -3/+7 |
| | | |||||
| * | Add the following root CAs, from SECOM Trust Systems / Security Communication | sthen | 2017-02-24 | 1 | -1/+126 |
| | | | | | | | | | of Japan, they are present in Mozilla's CA store. OK ajacoutot@ /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1 /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 /C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1 | ||||
| * | Check return value of every BN_* functions in bntest | inoguchi | 2017-02-23 | 1 | -393/+426 |
| | | | | | | | | - add macro CHECK_GOTO - unify function return code to rc - add err: label for error goto ok bcook@ | ||||
| * | Remove STREEBOG 512 as a TLS MAC since there are currently no cipher suites | jsing | 2017-02-21 | 2 | -26/+6 |
| | | | | | | | that make use of it. ok bcook@ inoguchi@ | ||||
| * | don;t end Nd with a full stop; | jmc | 2017-02-21 | 1 | -3/+3 |
| | | |||||
| * | Add missing $OpenBSD$ | beck | 2017-02-20 | 1 | -0/+1 |
| | | |||||
| * | Mark ERR_add_error_data and ERR_add_error_vdata as not for internal use, | beck | 2017-02-20 | 5 | -14/+81 |
| | | | | | | and document ERR_asprintf_error_data as their replacement. ok jsing@, ingo@ | ||||
| * | spelling fix; | jmc | 2017-02-20 | 1 | -2/+2 |
| | | |||||
| * | document tls_config_error(3) RETURN VALUES, improve what is said | schwarze | 2017-02-20 | 2 | -6/+59 |
| | | | | | | about tls_error(3), and warn about some traps; OK jmc@ | ||||
| * | Add EDNS0 support. | jca | 2017-02-18 | 1 | -4/+3 |
| | | | | | | | | EDNS allows for various DNS extensions, among which UDP DNS packets size bigger than 512 bytes. The default is still to not advertize anything. ok eric@ | ||||
| * | Avoid dereferencing a pointer when reporting an error about the same | jsing | 2017-02-15 | 1 | -2/+2 |
| | | | | | | | pointer being NULL. Found by jsg@ with cppcheck; also detected by Coverity. | ||||
| * | Add a NULL test to wrterror() to avoid a NULL deref when called from a | jsg | 2017-02-15 | 1 | -2/+2 |
| | | | | | | | free() error path. ok otto@ | ||||
| * | bump to 2.5.2 | bcook | 2017-02-14 | 1 | -3/+3 |
| | | |||||
| * | malloc does not *need* to return page-aligned objects for size >= | otto | 2017-02-12 | 1 | -5/+2 |
| | | | | | | a page. This is not required by any standard and other malloc implementation do not document (or implement) this. ok deraadt@ | ||||
| * | When netcat was started with -Uz, the exit status was always 1. If | bluhm | 2017-02-09 | 1 | -3/+4 |
| | | | | | | | the unix connect is successful, let nc -z close the socket and exit with 0. OK jca@ | ||||
| * | Document that -x can take an ipv6 address enclosed in square brackets. | jca | 2017-02-09 | 1 | -2/+5 |
| | | |||||
| * | When getaddrinfo fails, print the requested host and port. | jca | 2017-02-09 | 1 | -2/+3 |
| | | | | | Should make debugging easier, especially when using -x literal_ipv6_address | ||||
| * | DES keys are not 7 days long. ok jsing@ | dtucker | 2017-02-09 | 2 | -5/+5 |
| | | |||||
| * | Avoid a busy loop in netcat's tls_close(). Reuse the tls_handshake() | bluhm | 2017-02-08 | 1 | -18/+8 |
| | | | | | | wrapper that calls poll(2) and handles the -w timeout. OK beck@ | ||||
| * | Avoid double close(2) in netcat. After every call to readwrite() | bluhm | 2017-02-08 | 1 | -13/+5 |
| | | | | | | there is already a close(2), so do not do it in readwrite(). OK beck@ | ||||
| * | Due to non-blocking sockets, tls_handshake() could wait in a busy | bluhm | 2017-02-08 | 1 | -21/+42 |
| | | | | | | | loop. Use an additional poll(2) during the handshake and also respect the -w timeout option there. From Shuo Chen; OK beck@ | ||||
| * | Revert previous; the implementation is incorrect since it assumes that the | jsing | 2017-02-07 | 2 | -20/+7 |
| | | | | | | provided error code matches the error that is currently on the top of the error stack. | ||||
| * | Remove unused variable in C source to make the test compile and pass. | bluhm | 2017-02-07 | 1 | -1/+0 |
| | | |||||
| * | Add file and line to the LibreSSL error strings sine we are no longer in | beck | 2017-02-07 | 2 | -7/+20 |
| | | | | | | | | 1989, VMS, or MS/DOS and we all run Brobdingnagian C compilers that have can now be counted on to achieve this level of sophistication nearly everywhere. ok jsing@ | ||||
| * | Change SSLerror() back to taking two args, with the first one being an SSL *. | beck | 2017-02-07 | 25 | -573/+841 |
| | | | | | | | | | | Make a table of "function codes" which maps the internal state of the SSL * to something like a useful name so in a typical error in the connection you know in what sort of place in the handshake things happened. (instead of by arcane function name). Add SSLerrorx() for when we don't have an SSL * ok jsing@ after us both being prodded by bluhm@ to make it not terrible | ||||
| * | Define values for SSL_CTRL_SET_GROUPS{,_LIST} and wire them up to the | jsing | 2017-02-05 | 2 | -15/+19 |
| | | | | | | | | | SSL_{,CTX_}ctrl() functions. As crazy as it is, some software appears to call the control functions directly rather than using the macros (or functions) provided by the library. Discussed with beck@ and sthen@ | ||||
| * | Kill leak introduced with refactor | beck | 2017-02-05 | 1 | -3/+6 |
| | | | | | ok jsing@ | ||||
| * | Support IPv6 proxy addresses | jca | 2017-02-05 | 1 | -10/+24 |
| | | | | | ok beck@ | ||||
| * | Don't use <sys/param.h> from userland without cause. Sort <sys/*> | guenther | 2017-02-03 | 1 | -3/+4 |
| | | | | | | | before other includes per style(9) while we're here. ok florian@ bcook@ jsing@ beck@ | ||||
| * | fix a comment and rm some dead code as a result of the previous diff | otto | 2017-02-02 | 1 | -8/+5 |
| | | |||||
| * | netinet/in.h should be included, and freebsd and some others | beck | 2017-02-01 | 2 | -2/+6 |
| | | | | | | don't have EAI_NODATA, so make this easier for people from bernard spill | ||||
| * | Let realloc handle and produce moved pointers for allocations betweenlibressl-v2.5.1 | otto | 2017-02-01 | 1 | -20/+37 |
| | | | | | half a page and a page. ok jmatthew@ tb@ | ||||
| * | tweak previous; | jmc | 2017-01-31 | 2 | -12/+8 |
| | | |||||
| * | Add tls_config_[add|set]keypair_ocsp functions so that ocsp staples may be | beck | 2017-01-31 | 6 | -58/+209 |
| | | | | | | | | | added associated to a keypair used for SNI, and are usable for more than just the "main" certificate. Modify httpd to use this. Bump libtls minor. ok jsing@ | ||||
| * | Disable client-initiated renegotiation for libtls servers. | jsing | 2017-01-31 | 1 | -1/+3 |
| | | | | | ok beck@ reyk@ | ||||
 |
index : openbsd | |
| A mirror of https://github.com/libressl/openbsd.git |
| summaryrefslogtreecommitdiff |