summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-09-20cap channel input buffer size at 16MB; avoids high memory use whenDamien Miller
peer advertises a large window but is slow to consume the data we send (e.g. because of a slow network) reported by Pierre-Yves David fix with & ok markus@
2020-09-20Fix a memory leak in x509_constraints_extract_namesTheo Buehler
If the default path of the switch is taken, vname will not be added to the names list and will leak when it is set to NULL. Simplify the logic by eliminating the add Boolean. Instead, free and zero vname in the default case and continue the while loop directly. At the bottom of the switch, add vname to the names list unconditionally zero it out since it's now owned by names. Found by Guido Vranken's cryptofuzzer ok beck
2020-09-19Add SHA2_384 and SHA2_512 to default proposals.tobhe
ok patrick@
2020-09-19Fix frame pointer slot on aarch64 for functions that do not save calleemortimer
registers with retguard enabled. ok kettenis@
2020-09-19remove superfluous NULL checkBob Beck
ok tb@
2020-08-03Import LLVM 10.0.0 release including clang, lld and lldb.Patrick Wildt
ok hackroom tested by plenty
2020-09-19Prepare to provide SSL_get0_peernameTheo Buehler
This is a convenience reacharound to libcrypto that trivially wraps X509_VERIFY_PARAM_get0_peername(). It is used by unbound 1.11.0 for better logging. As it's part of the API that landed with OpenSSL's DANE, more recent postfix snapshots use it as well. ok beck inoguchi jsing
2020-09-19Prepare to provide stubbed out versions for reading/writing 0-RTT dataTheo Buehler
We do not support this feature but need to provide OpenSSL's API since software assumes it's available whenever TLS1_3_VERSION is available. These are minimal stubs that should have a decent chance to interact reasonably with software expecting the tricky upstream semantics, but this will have to be sorted out with runtime testing, so will likely have to be refined and revisited. ok beck jsing
2020-09-19Prepare to provide SSL{,_CTX}_{get,set}_max_early_dataTheo Buehler
Similar to the SSL_SESSION versions, these are noops that are expected to be available by some configure tests. ok beck jsing
2020-09-19Prepare to provide SSL_SESSION_{set,get}_max_early_data()Theo Buehler
Since we do not support 0-RTT, these are noops. Some software expects this API to be available if TLS1_3_VERSION is defined. ok beck jsing
2020-09-19syncTheo Buehler
2020-09-19Add a bsd.schema line to the example ldapd.confTheo Buehler
from reyk
2020-09-19Add a bsd.schema including a shadowPassword and an sshPublicKeyTheo Buehler
attribute that can be used to extend existing LDAP users with the additional bsdAccount objectclass. The former is useful for ypldap+ldapd setups without login_ldap and the latter makes it easier to use sshd's AuthorizedKeysCommand. Originally from reyk, revived by Aisha Tammy, with input from many, especially Robert Klein.
2020-09-18fix typo in comment and trailing whitespaceJasper Lievisse Adriaanse
2020-09-18zap trailing whitespace;Jason McIntyre
2020-09-18various fixes; ok mpiJason McIntyre
2020-09-18Fix memory leak in 'n->name'.tobhe
2020-09-18If ssl_cert_dup() fails in SSL_set_SSL_CTX(3), return failureIngo Schwarze
rather than silently leaving a NULL pointer in ssl->cert. Kurt Roeckx fixed the same bug similarly in OpenSSL in 2015. While here, (1) make the code easier to read and more robust by returning right away when ssl still uses the context it was created from and the ctx argument is NULL, rather than doing a lot of work that changes nothing unless data is already corrupt, and (2) use the shorter and more inituitive SSL_CTX_up_ref(3) rather than manually calling CRYPTO_add(3), which means no functional change and is also in the OpenSSL 1.1 branch. OK tb@
2020-09-18add forgotten link to newish page SSL_set1_host(3)Ingo Schwarze
and update merge notice
2020-09-18Move variable declaration to beginning of scope in order to make thisTheo Buehler
test compile and pass on sparc64.
2020-09-18make this test compile and pass on sparc64 by moving variable declarationsTheo Buehler
to the beginning of the respective scopes (and out of for loops)
2020-09-18move variable declaration up to top to make this compile and passTheo Buehler
on sparc64
2020-09-18Use void function argument to appease gcc 4.2.1Theo Buehler
2020-09-18fix "warning: value computed is not used"Theo Buehler
Add a cast to tell gcc 4.2.1 that the return value is deliberately ignored. This makes the test compile and pass on sparc64.
2020-09-18fix "warning: function declaration isn't a prototype"Theo Buehler
Make tests compile and pass on sparc64 with gcc 4.2.1 by properly declaring "static int foo()" as "static int foo(void)".
2020-09-18Free buffer earlier to avoid confusing some compilers, GitHub issueNicholas Marriott
2382.
2020-09-18Some other warnings, GitHub issue 2382.Nicholas Marriott
2020-09-18zap redundant lineTheo Buehler
2020-09-18hook symbols test to regressTheo Buehler
2020-09-18Check availability of the symbols in Symbols.listTheo Buehler
This regress parses Symbols.list and pulls all public headers out of libcrypto's Makefile to generate a simple program that uses all public symbols. A number of symbols need to be declared extern since they are unavailable in public headers and a handful must be skipped since they are apparently architecture dependent. This would have caught the recent breakage due to the accidental removal of the NAME_CONSTRAINTS_check() function and points out a number of places where cleanup may happen in the future. discussed with beck
2020-09-18Fix potential overflow in CN subject line parsing, thanks toBob Beck
ASN1_STRING - the gift that keeps on giving. Found by Guido Vranken's cryptofuzzer. ok tb@
2020-09-18handle multiple messages in a single read()Damien Miller
PR#183 by Dennis Kaarsemaker; feedback and ok markus@
2020-09-18tweak the client hostkey preference ordering algorithm to prefer theDamien Miller
default ordering if the user has a key that matches the best-preference default algorithm. feedback and ok markus@
2020-09-17document min/max/sum functionJasper Lievisse Adriaanse
ok mpi@
2020-09-17With the multi rdomain support, slaacd now sees all icmpv6 packets andSebastien Marie
filters in userland. But the packet type check was placed at the wrong place so the hoplimit check was done against every icmpv6 packet but no all of them have a hoplimit constraint. tested and ok by me, committed on behalf of florian@
2020-09-17Prepare to provide SSL_get_peer_tmp_key().Joel Sing
OpenSSL effectively renamed SSL_get_server_tmp_key() to SSL_get_peer_tmp_key() and removed the client-side restriction. Prepare for a matching rename. ok tb@
2020-09-17Simplify SSL method lookups.Joel Sing
There are three places where we call tls1_get_{client,server}_method() and if that returns NULL, call dtls1_get_{client,server}_method(). Simplify this by combining the lookup into a single function. While here also use uint16_t for version types. ok inoguchi@ millert@
2020-09-17Fix the previous commit whose conditions were reversed.YASUOKA Masahiko
ok kn
2020-09-17Set retransmit timeout for DELETE message on the replaced SA, not ontobhe
the replacement. ok markus@
2020-09-17Do not send DELETE messages for closing SAs.tobhe
ok markus@
2020-09-17Make pfctl(8) check if the rtable really exists when parsing theYASUOKA Masahiko
config. work with and diff from kn ok kn
2020-09-17tab vs. spaces; from navan AT airpost.net, thanks!Florian Obser
2020-09-17Merge IKEV2_EXCHANGE_CREATE_CHILD_SA and IKEV2_EXCHANGE_INFORMATIONALtobhe
cases.
2020-09-17Add a comment saying that the public function NAME_CONSTRAINTS_check(3)Ingo Schwarze
is intentionally undocumented and needs to be deprecated. No change of the formatted text.
2020-09-17syncStuart Henderson
2020-09-17Document the WSDISPLAYIO_GETSCREENTYPE ioctl in wsdisplay.4.Frederic Cambus
OK jmc@, kn@, "go for it" kettenis@
2020-09-17Install the new page SSL_set1_host(3), link to it from relevant places,Ingo Schwarze
and add two other .Xrs that might help readers find their way. Update the merge notices of all files touched and merge a few trivial changes from the OpenSSL 1.1.1 branch. OK tb@
2020-09-17Import a manual page for SSL_set1_host(3), which we already have since 6.5,Ingo Schwarze
and for SSL_get0_peername(3), which tb@ will soon make available, from the OpenSSL 1.1.1 branch, which is still under a free license, deleting parts that do not apply to OpenBSD, and tweaked by me. Several improvements and OK by tb@.
2020-09-17afs, nnpfs, and procfs are no longer supported,Ingo Schwarze
so stop looking for them in mount(8) output; no functional change intended; OK millert@
2020-09-16Move all the EAP logic from a single branch in the message parsing code totobhe
somewhere past successful message verification, closer to where the other exchanges are handled. EAP is stll special, but this fits a lot better into the overall architecture. Tested with iOS, Stronswan and Windows ok patrick@ sthen@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-27 22:14:47 +0000