summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-01-05Use KNF for licence commentTheo Buehler
ok jsing
2021-01-05Move tls13_secrets_destroy() below _create()Theo Buehler
ok jsing
2021-01-05Convert tls13_secrets_{create,destroy}() to tls13_secret_{init,cleanup}()Theo Buehler
ok jsing
2021-01-05Add tls13_secret_{init,cleanup}()Theo Buehler
These are two functions that will help streamlining various functions in the TLSv1.3 code that do not need to know about the interna of this struct. input/ok jsing
2021-01-05Fix indent.Joel Sing
2021-01-05Use consistent names in tls13_{client,server}_finished_{recv,send}().Joel Sing
In tls13_{client,server}_finished_recv() we use verify_data_len, which makes more sense than hmac_len. Use the same name in tls13_{client,server}_finished_send(), keeping things consistent between functions. ok tb@
2021-01-05Use legacy verifier when building auto chains.Joel Sing
The new verifier builds all chains, starting with the shortest possible path. It also does not currently return partial chains. Both of these things conflict with auto chain, where we want to build the longest possible chain (to include all intermediates, and probably the root unnecessarily), as well as using an incomplete chain when a trusted chain is not known. Depending on software configuration, we can end up building a chain consisting only of a leaf certificate, rather than a longer chain. This results in auto chain not including intermediates, which is undesireable. For now, switch auto chain building to use the legacy verifier. This should resolve the issues encountered by ajacoutot@ with sendmail. ok tb@
2021-01-05Handle X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE in new verifier.Joel Sing
Yet another mostly meaningless error value... Noted by and ok tb@
2021-01-05Gracefully handle root certificates being both trusted and untrusted.Joel Sing
When a certificate (namely a root) is specified as both a trusted and untrusted certificate, the new verifier will find multiple chains - the first being back to the trusted root certificate and a second via the root that is untrusted, followed by the trusted root certificate. This situation can be triggered by a server that (unnecessarily) includes the root certificate in its certificate list. While this validates correctly (using the first chain), it means that we encounter a failure while building the second chain due to the root certificate already being in the chain. When this occurs we call the verify callback indicating a bad certificate. Some sensitive software (including bacula and icinga), treat this single bad chain callback as terminal, even though we successfully verify the certificate. Avoid this problem by simply dumping the chain if we encounter a situation where the certificate is already in the chain and also a trusted root - we'll have already picked up the trusted root as a shorter path. Issue with icinga2 initially reported by Theodore Wynnychenko. Fix tested by sthen@ for both bacula and icinga2. ok tb@
2021-01-05Remove memset that was made redundant with the ASN1_time_parse()Theo Buehler
fix in libcrypto/asn1/a_time_tm.c r1.16. Suggested by jsing
2021-01-05distribute the gzip'd version of bsd.rd on platforms where we all bootTheo de Raadt
methods support it. if anyone finds a method which does not work, please speak up.
2021-01-05It is safe to call addr2sa with a bgpd_addr NULL pointerClaudio Jeker
2021-01-05Revert part of the last addr2sa change. When addr is NULL or AID_UNSPECClaudio Jeker
addr2sa needs to return NULL. Without this connection establishment fails because bind is called with a bad sockaddr.
2021-01-05Add AID_VPN_IPv[46] support to addr2sa. It only converts the address partClaudio Jeker
of the VPN address into a sockaddr but it allows to use log_sockaddr for all cases of log_addr now. OK florian@
2021-01-05double word fix; from martin vahlensieckJason McIntyre
2021-01-04the tx doorbell is next to the rx doorbell, not on top of it.David Gwynne
2021-01-04estructure sntrup761.sh to process all files in a single list, which willDarren Tucker
make it easier to reorder. Re-inline int32_MINMAX. ok tobhe@
2021-01-04Process pppoe(4) packets directly, do not queue through netiskn
Less scheduling, lock contention and queues. Previously, if_netisr() handled the net lock around those calls, now if_input_process() does it before calling ether_input(), so no need to add or remove NET_*LOCK() anywhere. OK mvs claudio
2021-01-04Regress from martijn@.rob
2021-01-04whitespaceTheo Buehler
2021-01-04Adjust to new sort order of roa-set.Claudio Jeker
2021-01-04Rename PFD_PIPE_ROUTE to PFD_PIPE_RDE which is a more obvious name.Claudio Jeker
Also change the startup code to use enum bgpd_process to select which process needs to be run. Makes the code in my opinion easier to understand. OK denis@
2021-01-04Keep the various free calls of tls13_record_layer_free() in theTheo Buehler
order of the struct members for reviewability. ok jsing
2021-01-04- fix use after free, when packet gets dropped.Alexandr Nedvedicky
patch submitted by Ralf Horstmann from ackstorm.de OK dlg@
2021-01-04Remove kernel lock from pppoe(4) input pathkn
"struct pppoe_softc" documents no member being protected by the kernel lock (alone); further review of the code paths starting from pppoeintr() shows no sleeping points which must be avoided in the softnet thread. Everything is fine as is to run without the big lock, so remove it. Tests sthen Feedback mpi mvs OK mvs claudio
2021-01-04Rework roa_cmp() so that the result does not depend on the endianess ofClaudio Jeker
the system. While at use memcmp in prefixset_cmp() as well for address checks. OK florian@
2021-01-04Use log_sockaddr() in log_addr() to print a struct bgpd_addr. This wayClaudio Jeker
IPv6 scoped addresses will print correctly. OK tb@ florian@
2021-01-04Minor refactoring in pf(4). Note that struct pfsync_state is noAlexander Bluhm
longer memcopied but assigned. Alignment should not be an issue as it is __packed. Part of a larger diff from dlg@; OK dlg@ sashan@
2021-01-04Remove unused `pipex_iface_context' struct.mvs
ok ok@ yasuoka@
2021-01-04Fix linking of regress tests after 'bgpctl show sets' addition.Theo Buehler
ok claudio
2021-01-04Add a variant of remain-on-exit that only keeps the pane if the programNicholas Marriott
failed, GitHub issue 2513.
2021-01-04Remove BER_TYPE_BOOLEAN, it's not part of the spec and I haven't seen itMartijn van Duren
used anywhere. OK jan@
2021-01-04use bus_dmamap_sync around updates to the doorbells.David Gwynne
ok jmatthew@
2021-01-03Bump default datasize-max and datasize-cur since clang now seems toMark Kettenis
require more than 768M to build itself.
2021-01-03Make consistent reference to pathname.rob
OK schwarze@, jmc@, deraadt@
2021-01-03Prevent redefinition of `crypto_int32' error with gcc3.tobhe
Fixes compilation on luna88k. Feedback millert@ Found by and ok aoyama@
2021-01-03Add space for ballooning clang.Visa Hankala
Moreover, this makes default datasize limits consistent mips64-wide.
2021-01-03Make CHIN() Boolean-valued and use this to turn an expression with aTheo Buehler
quintuple negation into one with a simple negation. From miod, ok millert
2021-01-03Create .1 backup files when acme-client is going to overwrite aFlorian Obser
certificate file. These files are not terribly big and they might become helpful if one re-creates a certificate with additional or removed domains and whishes to revoke the old cert (this part needs a bit of work to make it convenient to do). OK sthen
2021-01-03Increase file descriptor limit to allow long chains of splicedAlexander Bluhm
sockets in one test process.
2021-01-03Turn macros into inline functions so that there is no need to document inTheo Buehler
comments that they will evaluate their arguments multiple times. From miod, ok millert
2021-01-03Allocate address space for reposting vga devices using km_alloc(9) ratherJonathan Matthew
than uvm_km_valloc(9). ok kettenis@
2021-01-03add the missing EXIT STATUS and HISTORY sectionsIngo Schwarze
2021-01-03Obvious bugfix: requesting a long dictum from a file containing shortIngo Schwarze
ones only or vice versa is an error rather than a recipe for success.
2021-01-02fix inverted exit status of fortune -m;Ingo Schwarze
bug reported and patch provided by Tilo Stritzky <lfsdc at gmx dot de> on bugs@; OK martijn@
2021-01-02Re-apply our libc++ 8.0.0 patches to libc++ 10.0.1.Patrick Wildt
2021-01-02Adjust link path for libc++ to find libc++abi to match change of MakefilePatrick Wildt
and build location.
2021-01-02Remove two now-unused functions; a result of the categories removal.Todd C. Miller
From miod@, OK tb@
2021-01-02Check auth_mkvalue(3) return value for NULL (malloc failure).Todd C. Miller
For constant strings we don't actually need to use auth_mkvalue(3). Problem reported by Ross L Richardson.
2021-01-02Import libc++abi 10.0.1 release.Patrick Wildt
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 02:06:51 +0000