summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Rewrite the ENGINE_*(3) documentation from scratch - step 2,schwarze2018-04-158-395/+633
| | | | | | covering the remaining functions that were documented in engine(3), except for seven functions that are completely pointless and that were merely listed but not really documented.
* Rewrite the ENGINE_*(3) documentation from scratch (step 1,schwarze2018-04-1510-530/+1303
| | | | | covering 60% of the documented functions). The old, abominable engine(3) manual page shall die soon.
* In eng_lib.c rev. 1.14 2018/04/14 07:18:37, tb@ allowed ENGINE_free(3)schwarze2018-04-141-53/+46
| | | | | | to accept a NULL argument. Document that. While here, make the related sentences more precise and less verbose. Tweaks and OK tb@.
* Make ENGINE_free() succeed on NULL. Matches OpenSSL's behavior andtb2018-04-148-41/+41
| | | | | | simplifies the caller side. tested by & ok inoguchi; discussed with schwarze
* make ENGINE_finish() succeed on NULL and simplify callers as intb2018-04-1413-100/+58
| | | | | | | | | | | OpenSSL commit 7c96dbcdab9 by Rich Salz. This cleans up the caller side quite a bit and reduces the number of lines enclosed in #ifndef OPENSSL_NO_ENGINE. codesearch.debian.net shows that almost nothing checks the return value of ENGINE_finish(). While there, replace a few nearby 'if (!ptr)' with 'if (ptr == NULL)'. ok jsing, tested by & ok inoguchi
* In ssl.h rev. 1.155 2018/04/11 17:47:36, jsing@ changedschwarze2018-04-111-13/+3
| | | | | SSL_OP_TLS_ROLLBACK_BUG to no longer have any effect. Update the manual page.
* Nuke SSL_OP_TLS_ROLLBACK_BUG - this is a workaround for buggy clients fromjsing2018-04-112-36/+17
| | | | | | | around the SSLv3/TLSv1.0 period... and buggy clients are buggy. This also helps to clean up the RSA key exchange code. ok "kill it with fire" beck@ tb@
* Delete the description of the argument of the "ciphers" commandschwarze2018-04-101-145/+13
| | | | | | | | | because it was (1) woefully incomplete, (2) partially outdated and wrong, (3) in parts imprecisely worded and hard to understand, (4) excessively technical for a section 1 manual, (5) of excessive size for this particular page, (6) and didn't belong here in the first place because it essentially tried to document a C API - SSL_CTX_set_cipher_list(3), which is now documented, so point to it.
* Write documentation for the control string parameter from scratch,schwarze2018-04-101-30/+273
| | | | collecting the information by inspecting the source code.
* tweak usage()tb2018-04-101-1/+1
|
* Fail early if an X509_VERIFY_PARAM is poisoned - don't allowbeck2018-04-081-8/+10
| | | | | this to be "overridden" by the user supplied callback. ok jsing@
* sort the list of data structures and add the missing ECDH and ECDSA;schwarze2018-04-081-57/+13
| | | | | triggered by OpenSSL commit a73d990e Feb 27 19:02:24 2018 +0100, but with different content
* tweak previous;jmc2018-04-071-4/+4
|
* Correct man page for OpenSSL_no_config() to indicate that itbeck2018-04-071-4/+8
| | | | | suppresses any future config file loading. ok schwarze@ with a nit from jsing@
* Remove function pointers for ssl_{read,write,peek}.jsing2018-04-078-59/+11
| | | | | | | Now that everything goes through the same code path, we can remove a layer of indirection and just call ssl3_{read,write,peek} directly. ok beck@ inoguchi@
* Nuke SSL3_FLAGS_DELAY_CLIENT_FINISHED and SSL3_FLAGS_POP_BUFFER.jsing2018-04-074-70/+8
| | | | | | | These flags enabled experimental behaviour in the write path, which nothing uses. Removing this code greatly simplifies ssl3_write(). ok beck@ inoguchi@ sthen@ tb@
* Revise regress to match tls_keypair_clear() removal.jsing2018-04-071-18/+3
|
* Correct tls_config_clear_keys() behaviour.jsing2018-04-073-30/+18
| | | | | | | | | | | | | Previously this incorrectly called tls_keypair_clear(), which results in the private key being cleared, along with the certificate, OCSP staple and pubkey hash. This breaks OCSP stapling if tls_config_clear_keys() is called following tls_configure(), as is done by httpd. Fix this by calling tls_keypair_clear_key() so that only the private key is cleared, leaving the other public data untouched. While here, remove tls_keypair_clear() and fold the necessary parts into tls_keypair_free(). ok beck@
* Switch to OPENSSL_init_ssl() and prevent an openssl configuration file fromjsing2018-04-071-3/+2
| | | | | | being loaded behind our back, at a later point. ok beck@
* tweak previous;jmc2018-04-071-8/+8
|
* test X509_NAME_add_entry_by_txt(3); feedback and OK jsing@schwarze2018-04-074-2/+81
|
* sys/uio.h is not used anymoreotto2018-04-071-3/+2
|
* Revert revision 1.12 commit. Although *pval looks like a C pointer,bluhm2018-04-061-2/+5
| | | | | | | | it may be something else. For primitive types it is possible that a boolean int has been casted to an ASN1_VALUE pointer. Then the 64 bit read access to *pval may crash due to alignent or 32 bit size. bug report Anton Borowka; OK tedu@ jsing@ miod@
* Avoid leaking str if EVP_Digest() fails.tb2018-04-061-3/+6
| | | | | | | Found and fixed by Bernd Edlinger as part of OpenSSL commit 83b4049ab75e9da1815e9c854a9297bca3d4af6b ok jsing, deraadt, bcook
* poison for X509_VERIFY_PARAM'sbeck2018-04-064-45/+107
| | | | | | | | | | | | Tighten up checks for various X509_VERIFY_PARAM functions, and allow for the verify param to be poisoned (preculding future successful cert validation) if the setting of host, ip, or email for certificate validation fails. (since many callers do not check the return code in the wild and blunder along anyway) Inspired by some discussions with Adam Langley. ok jsing@
* Fix two bugs in X509_NAME_add_entry(3):schwarze2018-04-041-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | (1) Evaluate the "set" argument, which says whether to create a new RDN or to prepend or append to an existing one, before reusing it for a different purpose, i.e. for the "set" field of the new X509_NAME_ENTRY structure. (2) When incrementing of some "set" fields is needed, increment the correct ones: All those to the right of the newly inserted entry, but not the one of that entry itself. These two bugs caused wrong results whenever using loc != -1, i.e. whenever inserting rather than appending entries, even when using set == 0 only, that is, even when using single-values RDNs only. Both bugs have been continuously present since at least SSLeay-0.8.1 (released July 18, 1997) and the second one since at least SSLeay-0.8.0 (released June 25, 1997), so both are over twenty years old. I found these bugs by code inspection while trying to document the function X509_NAME_ENTRY_set(3), which is public, but undocumented in OpenSSL. OK beck@, jsing@
* KNF: move two opening curly braces of function bodies to their own linestb2018-04-032-4/+6
|
* Typo: typdef -> typedef.tb2018-04-031-3/+3
| | | | From Edgar Pettijohn
* Add missing $OpenBSD$ tags.tb2018-04-032-0/+2
|
* In ssl.h rev. 1.151 2018/03/17 15:48:31, tb@ providedschwarze2018-04-021-6/+34
| | | | | | | | SSL_CTX_get_default_passwd_cb(3) and SSL_CTX_get_default_passwd_cb_userdata(3). Merge the documentation, tweaked by me; from Christian Heimes <cheimes at redhat dot com> via OpenSSL commit 0c452abc Mar 2 12:53:40 2016 +0100.
* In x509_vfy.h rev. 1.26 2018/03/17 15:43:32, tb@ providedschwarze2018-04-021-6/+14
| | | | X509_STORE_get0_param(3); write the documentation from scratch.
* In x509_vfy.h rev. 1.25 2018/03/17 15:39:43, tb@ providedschwarze2018-04-021-4/+21
| | | | | X509_OBJECT_get_type(3). It is undocumented in OpenSSL, so write some documentation from scratch.
* When you replace an element in a sorted array with somethingschwarze2018-04-012-13/+6
| | | | | | | | | | | | | | | | arbitrarily different, the array is in general no longer sorted. This commit copies a small hidden bugfix from the OpenSSL commit https://github.com/openssl/openssl/commit/fbb7b33b the rest of which is merely cosmetics. I discovered the bug independently while documenting sk_find(3). Keep the library's idea of when an empty stack or a one-element stack is sorted and when it is not bug-compatible with OpenSSL, even though in fact, empty and one-element stacks are of course always sorted. OK beck@
* Improve description of openssl(1) ciphers.schwarze2018-03-311-9/+5
| | | | | | * Remove -tls1 option which has no effect. * For -V, sort the fields in the order they are printed, and do not talk about key size restrictions, nothing like that is printed.
* Updates to the description of "openssl ca" from OpenSSL.schwarze2018-03-301-23/+82
| | | | | Some options were missing, some were in the wrong section (CRL-related or not), and there were some minor errors, typos, and omissions.
* checked the content against the current version of OpenSSL openssl.pod;schwarze2018-03-301-5/+5
| | | | | resulting fixes: markup of "command" below SYNOPSIS and links to the config file formats below SEE ALSO
* fix typo; from <Alex dot Gaynor at gmail dot com>schwarze2018-03-301-4/+4
| | | | via OpenSSL commit 3266cf58 Mar 10 13:13:23 2018 -0500
* jsing@ points out to me that our X25519 interface was copied fromschwarze2018-03-301-98/+85
| | | | | | | | | | | | BoringSSL rather than from OpenSSL and that it is not hooked into evp(3). So delete all text from OpenSSL including the Copyright and license and replace it by some text assembled from comments in BoringSSL code and headers and some text written myself, all under ISC license. In particular, also describe X25519_keypair(3), add SYNOPSIS, RETURN VALUES, STANDARDS, and a reference to D. J. Bernsteins instructions on how to use the algorithm. Delete the text related to EVP_PKEY describing features we do not support.
* Add missing $OpenBSD$.jsing2018-03-301-0/+1
|
* fix MALLOC_STATS; spotted by and ok semarie@otto2018-03-301-1/+5
|
* include more information about how to create keys;schwarze2018-03-301-6/+19
| | | | | from Matt Caswell <matt at openssl dot org> via OpenSSL commit f929439f Mar 15 12:19:16 2018 +0000
* Add one short sentence each from the new OpenSSL X509_STORE_add_cert(3)schwarze2018-03-302-4/+10
| | | | | | manual page, which is below the threshold of originality, so there is no need to change the Copyright headers. The rest of that page is less clear and less precise than what we already have in our various pages.
* Remove mention of link between message digests and public key algorithms.schwarze2018-03-292-16/+8
| | | | | | | | | | | | | The comment in EVP_DigestInit.pod is: "EVP_MD_pkey_type() returns the NID of the public key signing algorithm associated with this digest. For example EVP_sha1() is associated with RSA so this will return NID_sha1WithRSAEncryption. Since digests and signature algorithms are no longer linked this function is only retained for compatibility reasons." So there is no link anymore. From <paul dot dale at oracle dot com> via OpenSSL commit 79b49fb0 Mar 20 10:03:10 2018 +1000
* missing "const" in seven prototypes;schwarze2018-03-291-16/+16
| | | | | from Kurt Roeckx <kurt at roeckx dot be> via OpenSSL commit b38fa985 Mar 10 16:32:55 2018 +0100
* describe EC_POINT_get_affine_coordinates_GFp(3) andschwarze2018-03-291-3/+15
| | | | | | EC_POINT_get_affine_coordinates_GF2m(3); from David Benjamin <davidben at google dot com> via OpenSSL commit ddc1caac Mar 6 14:00:24 2018 -0500
* correct callback argument for BIO_puts(3);schwarze2018-03-291-4/+4
| | | | | from <Bernd dot Edlinger at hotmail dot de> via OpenSSL commit c911e5da Mar 19 14:20:53 2018 +0100
* BIO_get_mem_data(3) and BIO_get_mem_ptr(3) assign to *pp, not to pp;schwarze2018-03-291-5/+5
| | | | | from <Matthias dot St dot Pierre at ncp dash e dot com> via OpenSSL commit 36359cec Mar 7 14:37:23 2018 +0100
* spelling; from <Alex dot Gaynor at gmail dot com>schwarze2018-03-291-5/+5
| | | | via OpenSSL commit d47eaaf4 Mar 9 07:11:13 2018 -0500
* missing words; from Ivan Filenko <ivan dot filenko at protonmail dot com>schwarze2018-03-291-5/+5
| | | | via OpenSSL commit 4a56d2a3 Feb 25 16:49:27 2018 +0300
* Fix three bugs in setlocale(3):schwarze2018-03-291-2/+2
| | | | | | | | | | | 1. setlocale(LC_ALL, "A"); setlocale(LC_CTYPE, "T"); setlocale(LC_ALL, NULL); must return "A/T/A/A/A/A", not "A". Fix this by always initializing the LC_ALL entry of newgl to "" in dupgl(). Reported by Karl Williamson <public at khwilliamson dot com> on bugs@, thanks! 2. Do not leak newgl when strdup(3) fails in setlocale(3). 3. For setlocale(LC_ALL, "C/C/fr_FR.UTF-8/C/C/C"); correctly set _GlobalRuneLocale; i found 2. and 3. while looking at the code. Feedback on a buggy earlier version and OK martijn@.
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-25 00:23:40 +0000