summaryrefslogtreecommitdiff
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Three independent typos for `independent' or `independently'.miod2014-08-192-2/+2
|
* replace more ROTATE macros with plain-old C code.bcook2014-08-184-80/+38
| | | | | | | Let the compiler optimize these. Even older versions of gcc generate equal or better quality code than the inline asm. ok miod@
* remove return value from HOST_c2l/l2c macrosbcook2014-08-1816-212/+212
| | | | | | | | | | | These macros and asm inlines simulate a function returning a value, but nothing ever uses this return value. Remove the pseudo-returns and (void) casts discarding the unused values. This, maybe unsurprisingly, speeds things up a bit. It also removes the GCC 4.9 warnings about unused values. ok miod@ deraadt@
* a small tweak to improve malloc in multithreaded programs. we don't needtedu2014-08-181-7/+21
| | | | | | | to hold the malloc lock across mmap syscalls in all cases. dropping it allows another thread to access the existing chunk cache if necessary. could be improved to be a bit more aggressive, but i've been testing this simple diff for some time now with good results.
* replace sprintf/strdup with asprintf in engine testbcook2014-08-161-8/+5
|
* only build the getrandom path if SYS_getrandom is defined.bcook2014-08-162-6/+14
| | | | like the sysctl path
* use C rather than C++ array initialization syntaxbcook2014-08-161-37/+37
| | | | this causes errors with stricter C compilers
* getrandom(2) support for getentropy_linuxbcook2014-08-162-26/+20
| | | | | | | | | | | This enables support for the new getrandom(2) syscall in Linux 3.17. If the call exists and fails, return a failure in getentropy(2) emulation as well. This adds a EINTR check in case the urandom pool is not initialized. Tested on Fedora Rawhide with 3.17rc0 and Ubuntu 14.04 ok deraadt@
* use void * instead of char *. ok jsingtedu2014-08-152-6/+6
|
* XPG requires insque() and remque() to work with linear lists and not justguenther2014-08-153-21/+26
| | | | | | | | | circular lists. Amazingly, they managed to extend the requirements to no longer match the behavior of the VAX instructions they were modeled after, so the trivial VAX ASM versions have to go. Nice job breaking it, X/Open! Based on a diff from enh (at) google.com ok miod@
* fixed overrid(d)en typotobias2014-08-143-5/+5
| | | | millert@ and jmc@ agree that "overriden" is wrong
* munmap correct object in (extremely unlikely, and effectively terminal)deraadt2014-08-136-12/+12
| | | | | case of failing to map the 2nd object. found by Paul Maurers
* Merge a patch that i successfully pushed to OpenSSL,schwarze2014-08-122-2/+2
| | | | | | | | | | | | | | | | | | | | | original OpenSSL commit message follows: Fixed as shown; to be released post-1.0.2 commit bebbb11d132cc149f7713d6693703f8bfae10072 Author: Ingo Schwarze <schwarze@usta.de> Date: Sat Jan 18 11:46:25 2014 +0100 RT3239: Extra comma in NAME lines of two manpages In two OpenSSL manual pages, in the NAME section, the last word of the name list is followed by a stray trailing comma. While this may seem minor, it is worth fixing because it may confuse some makewhatis(8) implementations. While here, also add the missing word "size" to the one line description in SSL_CTX_set_max_cert_list(3). Reviewed by: Dr Stephen Henson <shenson@drh-consultancy.co.uk>
* Replace intrinsic ROTATE macros with an inline.bcook2014-08-122-82/+20
| | | | | Without the cast/mask, the compiler is allowed to optimize this directly to the correct CPU intrinsic for rotate.
* Guard RSA / RC4-5 ASM when NO_ASM is not definedbcook2014-08-116-12/+18
| | | | | | | | | Most assembly blocks remain inactive if OPENSSL_NO_ASM is not defined, only enabling inline assembly, but the RSA / RC4-5 blocks (used only in amd64 systems) turn on implicitly. Guard these two as well. This simplifies enabling just inline ASM in portable, no effective change in OpenBSD.
* Check the return value of sk_SSL_CIPHER_new_null(), since it allocatesjsing2014-08-112-10/+14
| | | | | | memory and can return NULL. ok miod@
* Unchecked memory allocation and potential leak upon error inmiod2014-08-112-10/+24
| | | | | ssl3_get_cert_verify(). ok guenther@ jsing@
* Remove now-unused SSL2_STATE as well as ssl2-specific state machine values.miod2014-08-112-234/+2
| | | | ok guenther@ jsing@
* Currently, ssl3_put_char_by_bytes(NULL, NULL) is just a long handed wayjsing2014-08-116-26/+24
| | | | | | | | of writing "2". Add a define for the SSL3_CIPHER_VALUE_SIZE (rather than using a less-readable hardcoded constant everywhere) and replace the ssl3_put_char_by_bytes(NULL, NULL) calls with it. ok bcook@ miod@
* Provide a ssl3_get_cipher_by_id() function that allows ciphers to be lookedjsing2014-08-116-30/+36
| | | | | | | | up by their ID. For one, this avoids an ugly mess in ssl_sess.c, where the cipher value is manually written into a buffer, just so the cipher can be located using ssl3_get_cipher_by_char(). ok bcook@ miod@
* Tweak cipher list comments and add missing cipher value comments.jsing2014-08-102-10/+52
|
* Remove disabled (weakened export and non-ephemeral DH) cipher suites fromjsing2014-08-102-940/+10
| | | | | | | | the cipher list. This reduces code size, saves data segment space and prevents them from being turned back on at runtime by flipping a bit in memory. ok guenther@
* Since we no longer need to support SSLv2-style cipher lists, startjsing2014-08-1032-182/+68
| | | | | | | | | | unravelling the maze of function pointers and callbacks by directly calling ssl3_{get,put}_cipher_by_char() and removing the ssl_{get,put}_cipher_by_char macros. Prompted by similar changes in boringssl. ok guenther.
* AF_IMPLINK and AF_BLUETOOTH are gone, but add printing of SOCK_SEQPACKETguenther2014-08-101-6/+5
|
* Only need <stdint.h> and not all of <inttypes.h> hereguenther2014-08-101-2/+2
|
* Fix CVE-2014-3507, avoid allocating and then leaking a fresh fragmentguenther2014-08-082-4/+14
| | | | | | | | | structure when a zero-length fragment is received. Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74 diff by miod@, ok guenther@ bcook@ deraadt@
* Fix CVE-2014-3508, pretty printing and OID validation:guenther2014-08-084-24/+56
| | | | | | | | | | | - make sure the output buffer is always NUL terminated if buf_len was initially greater than zero. - reject OIDs that are too long, too short, or not in proper base-127 Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87 ok bcook@
* Correct test reversed during merge of fix for CVE-2014-3509guenther2014-08-072-4/+4
| | | | | pointed out by Watson Ladd (watson (at) matasano.com) ok deraadt@
* Fix CVE-2014-3506, DTLS handshake message size checks. Fromguenther2014-08-072-32/+44
| | | | | | | https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1250f12613b61758675848f6600ebd914ccd7636 with comment/whitespace style tweaks ok bcook@ miod@
* Oops, revert changes commited by mistake. The previous commit was supposedmiod2014-08-0713-53/+59
| | | | to only apply to s23_srvr.c.
* When you expect a function to return a particular value, don't put a commentmiod2014-08-0715-71/+59
| | | | | | | | | | | saying that you expect it to return that value and compare it against zero because it is supposedly faster, for this leads to bugs (especially given the high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this library). Instead, compare for the exact value it ought to return upon success. ok deraadt@
* Fix CVE-2014-3511; TLS downgrade, verbatim diffderaadt2014-08-072-10/+54
| | | | | https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b ok guenther miod
* merge CVE-2014-3510; Fix DTLS anonymous EC(DH) denial of servicederaadt2014-08-072-2/+18
| | | | | https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=17160033765480453be0a41335fa6b833691c049 ok bcook
* merge fix for CVE-2014-3509 -- basically a missing s->hit check; ok guentherderaadt2014-08-062-18/+26
|
* Prevent a possible use after free by mimicing the s3_srvr.c fixes contributed bymiod2014-08-062-8/+2
| | | | | | | Adam Langley close to three years ago, which were commited in https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e7928282d0148af5f28fa3437a625a2006af0214 ok jsing@
* Allow B64_EOF to follow a base64 padding character. This restores previousjsing2014-08-062-4/+6
| | | | | | | | behaviour that allows a PEM block to be fed through the base64 decoder. Reported by Dmitry Eremin-Solenikov on tech@ ok deraadt@ tedu@
* Correct error checks in EVP_read_pw_string_min(): UI_add_input_string()guenther2014-08-062-6/+6
| | | | | | | | and UI_add_verify_string() return -1 (and maybe -2?) on failure and >=0 on success, instead of always zero on success problem reported by Mark Patruck (mark (at) wrapped.cx) ok miod@
* Add support for loading the public/private key from memory, rather thanjsing2014-08-064-13/+97
| | | | directly from file.
* Add $OpenBSD$ tags.jsing2014-08-058-0/+8
|
* Implement ressl_accept_socket, which allocates a new server connectionjsing2014-08-042-4/+45
| | | | | context (if necessary) and handles the TLS/SSL handshake over the given socket.
* Return -1 on error (not 1).jsing2014-08-041-3/+3
|
* A ressl server needs different configuration from a ressl client - providejsing2014-08-043-0/+41
| | | | | a specific server configuration function and call this from ressl_configure.
* Provide a function that returns a server connection context.jsing2014-08-042-0/+15
|
* Provide a utility function for loading a private/public keypair.jsing2014-08-042-0/+21
|
* Improve ressl_{read,write} handling of non-blocking reads/writes.jsing2014-08-042-16/+31
|
* Free the SSL context first and let the reference counting do its thing.jsing2014-08-041-5/+2
|
* In chacha_init(), allow for a NULL iv. Reported by znz on github.miod2014-08-042-4/+6
| | | | ok guenther@ jsing@
* X509_NAME_get_text_by_NID() returns -1 on error so the typejsg2014-08-031-1/+1
| | | | | | the return value is stored in must be signed. Fixes a test for error. ok jsing@ guenther@
* Fix a usage string; the proper spelling of 'alot' is 'a lot'.blambert2014-07-291-2/+2
| | | | ok bcook@
* Remove SRP code. It contains a bug (this should not surprise anyone), buttedu2014-07-2812-3635/+2
| | | | | | | | | | | the details are under embargo. The original plan was to wait for the embargo to lift, but we've been waiting for quite some time, and there's no indication of when or even if it will end. No sense in dragging this out any longer. The SRP code has never been enabled in OpenBSD, though I understand it is in use by some other people. However, in light of this and other issues, we're officially saying SRP is outside the scope of libressl. (For now.)
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-28 02:38:06 +0000