summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-11-18sha256test: EVP_MD_CTX_cleanup -> EVP_MD_CTX_resetTheo Buehler
2021-11-18gost2814789t: EVP_MD_CTX_cleanup -> EVP_MD_CTX_resetTheo Buehler
2021-11-18evptest: no need to call EVP_MD_CTX_cleanup() before EVP_MD_CTX_free()Theo Buehler
2021-11-18avoid xmalloc(0) for PKCS#11 keyid for ECDSA keys (we already did thisDamien Miller
for RSA keys). Avoids fatal errors for PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B "cryptoauthlib"; bz#3364
2021-11-18Use HMAC_CTX_reset() instead of HMAC_CTX_cleanup() + HMAC_CTX_init()Theo Buehler
2021-11-18Add semicolon that will become non-optional once BN_GENCB_set() willTheo Buehler
move from an awful macro to a proper function.
2021-11-18typo in commentTheo Buehler
2021-11-18acme-client: use EVP_PKEY_base_id()Theo Buehler
In an upcoming libcrypto bump, EVP_PKEY will become opaque. In order to stop reaching inside EVP_PKEY, we must replace EVP_PKEY_type(pkey->type) with the equivalent EVP_PKEY_base_Id(pkey) in various places. ok florian
2021-11-18vndsetcred: don't a reference to credentials in error path.Theo Buehler
ok deraadt
2021-11-18Fix ssltest to work with opaque EVP_PKEY.Theo Buehler
2021-11-18Prevent future internal use of ASN1_CTX and ASN1_const_CTX by wrappingTheo Buehler
them inside #ifndef LIBRESSL_INTERNAL. suggested by jsing
2021-11-18Remove the last pointless use of ASN1_const_CTX. Both ASN1_CTX andTheo Buehler
ASN1_const_CTX are now unused and will be garbage collected in the next libcrypto bump. ok jsing
2021-11-18sha*test: convert these tests to work with opaque EVP_MD_CTX.Theo Buehler
2021-11-18zap trailing whitespaceTheo Buehler
2021-11-18hmactest: convert to opaque HMAC_CTX.Theo Buehler
2021-11-18gost2814789t: convert to opaque EVP_{MD,CIPHER}_CTX.Theo Buehler
2021-11-18exptest: convert to opaque BN; minor KNF tweaks.Theo Buehler
2021-11-18evptest: fix compilation with opaque EVP_{CIPHER,MD}_CTX. Uses aTheo Buehler
workaround for excessive malloc inspired by mariadb (just kidding).
2021-11-18ecdsatest: make this test compile with opaque EVP_MD_CTX.Theo Buehler
2021-11-18dsatest: make this work with opaque BN. Some more fixes will be neededTheo Buehler
for opaque DSA. I'll deal with that later. I also lobbed a KNF grenade in here.
2021-11-18dhtest: fix this to work with opaque BN. This will need more fixes toTheo Buehler
work with opaque DH, but one step at a time. While here, add a bunch of missing spaces to reduce the eyebleed.
2021-11-18bntest: Fix all but one test in this file to work with opaque BN.Theo Buehler
The remaining test needs some thinking (or disabling once we flip the switch). It is currently marked with an XXX.
2021-11-18Remove X11 blt and bltone regress tests. They fail with the currentAlexander Bluhm
X server and have been unlinked from the build. Converting the tests from libfb to libwfb could be possible, but nobody is working on that. OK matthieu@ kettenis@
2021-11-18printing udpencap_port in ddb requires ntohs not ntohl. use better formatStuart Henderson
string. help claudio@ ok bluhm@
2021-11-18In x509_vfy.h rev. 1.35 and x509_lu.c rev. 1.34, tb@ providedIngo Schwarze
X509_OBJECT_new(3) and X509_OBJECT_free(3); document them. While here, stop talking about storing storing EVP_PKEY objects and plain C strings in X509_OBJECT objects. LibreSSL never fully supported that, and it certainly no longer supports that now.
2021-11-18Move example from "goo" to @tag.Antoine Jacoutot
2021-11-18regression test for ssh-keygen -Y find-principals fix;Damien Miller
from Fabian Stelzer ok djm markus
2021-11-18ssh-keygen -Y find-principals was verifying key validity when usingDamien Miller
ca certs but not with simple key lifetimes within the allowed signers file. Since it returns the first keys principal it finds this could result in a principal with an expired key even though a valid one is just below. patch from Fabian Stelzer; feedback/ok djm markus
2021-11-18check for POLLHUP wherever we check for POLLINDamien Miller
2021-11-18fd leak in sshd listen loop error path; from Gleb SmirnoffDamien Miller
2021-11-18check for POLLHUP as well as POLLIN in sshd listen loop;Damien Miller
ok deraadt millert
2021-11-18check for POLLHUP as well as POLLIN, handle transient IO errors as wellDamien Miller
as half-close on the output side; ok deraadt millert
2021-11-18syncTheo de Raadt
2021-11-17uniq(1): ignore trailing newlines when comparing linesScott Soule Cheloha
POSIX.1-2008 tweaked the uniq definition in light of AGI 1003.1-2001 #133. uniq must now *ignore* the trailing newline when comparing lines from the input. In practice this means that if the last line in the input is missing a trailing newline it isn't necessarily different from the line preceding it. So, uniq(1) now stubs the trailing newline before doing any line comparisons. For sake of simplicity, this patch introduces a second change: if the last line in the input is missing a trailing newline and we choose to print the line, a newline is appended when we print it. Adopting the newline change aligns our implementation with with POSIX.1-2008 (which we already claim in the manpage). Adopting both changes aligns our behavior with that of FreeBSD and GNU uniq. For better or worse, OpenBSD's uniq no longer behaves like NetBSD's uniq in this corner case. References: POSIX.1-2001 uniq: https://pubs.opengroup.org/onlinepubs/009695399/utilities/uniq.html Austin Group Interpretation 1003.1-2001 #133: https://collaboration.opengroup.org/austin/interps/documents/14355/AI-133.txt POSIX.1-2008 uniq: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/uniq.html -- Discussed with millert@. With input from schwarze@. Positive feedback from bcallah@. Thread: https://marc.info/?l=openbsd-tech&m=163581613829524&w=2 ok millert@
2021-11-17When unp_connect() releases both solock() and vnode(9) locks the socket weVitaliy Makkoveev
were connected could be closed by concurrent thread. Check connection state and return ECONNREFUSED if the connection was lost. ok bluhm@
2021-11-17set num_listen_socks to 0 on close-all instead of -1, whichDamien Miller
interferes with the new poll()-based listen loop; spotted and debugged by anton@+deraadt@
2021-11-17Display DNS information from sppp(4) in ifconfig(8)Bjorn Ketelaars
Behaviour is similar to that of umb(4). OK kn@
2021-11-17In x509_vfy.h rev. 1.37 and x509_vfy.c rev. 1.91, tb@ providedIngo Schwarze
X509_STORE_CTX_set_verify(3) and X509_STORE_CTX_get_verify(3). Document them. In the next bump, tb@ will also provide X509_STORE_CTX_verify_fn(3) and X509_STORE_set_verify(3) and restore X509_STORE_set_verify_func(3) to working order. For efficiency of documentation work, already document those three, too, but keep the text temporariy .if'ed out until they become available. Delete X509_STORE_set_verify_func(3) from X509_STORE_set_verify_cb_func(3) because it was misplaced in that page: it is not related to the verification callback. tb@ agrees with the general direction.
2021-11-17Disable active scanning on iwm(4) 9260 and 9560.Stefan Sperling
For some reason, if we send a scan command that actively scans for a particular SSID with probe requests, the device will occasionally lock up after associating to the AP, with no interrupts, totally dead. The symptom of this is an interface that shows as "active" in ifconfig but does not receive or transmit any packets. Observed by kmos@ for some time already, and myself while testing new Intel wifi firmware versions on iwm(4) 9560. This problem was also observed on AX200 by me with old firmware. We had the same workaround in place for iwx(4) for some time, until we upgraded that driver to use newer firmware which uses a different scan command. Workaround tested by kmos@ and myself.
2021-11-17Clarify BUGS wrt. reserving memory for the hypervisorKlemens Nanni
The previous wording might be understood as "leave memory unused in the primary domain", which is precisely what causes the hypervisor to reject the configuration since ldomctl(8) would implicitly allocate all remaining memory for the primary domain. Make sure that primary domain memory should be assigned explicitly so the total amount of allocated memory is less than physically available, i.e. the hypervisor will have even more memory available and configurations can boot again. OK stsp
2021-11-17Provide real output for the "ldomctl console" EXAMPLEKlemens Nanni
2021-11-17explicitly talk a bit about "informal" specsMarc Espie
2021-11-17forbid non-sensical empty partsMarc Espie
explicitly forbid % to be in packages-specs, so that people don't get confused about it.
2021-11-17add more checks for badly specified pkgspecsMarc Espie
2021-11-17uhidpp does claim multiple report idsAnton Lindqvist
2021-11-17ucc does not claim multiple report idsAnton Lindqvist
2021-11-17Fix a double free in uhidev_close() caused by a race betweenAnton Lindqvist
uhidev_open() and uhidev_close(). In uhidev_close() the UHIDEV_OPEN flag is cleared early on but the same thread can end up sleeping while closing the input or output pipe. This allows another thread to enter uhidev_open() but only to fail opening either the input or output pipe since they are already open for exclusive use. The uhidev_open() error path frees the input buffer but leaves a dangling pointer around; causing uhidev_close() to free the same buffer. This can at least happen on xhci(4) which can end up sleeping in xhci_pipe_close(). Reported by and ok gnezdo@
2021-11-16wc(1): fix NULL pointer dereference in cnt()Scott Soule Cheloha
If the "file" argument to cnt() is NULL and we call warn(3) we will get a NULL dereference. Change the name of the argument to "path" and make "file" a local variable. Ensure that we set "file" to a valid C-string, even if "path" is NULL. While we're here, const the file name pointers, too. Thread: https://marc.info/?l=openbsd-tech&m=163708784422157&w=2 ok millert@
2021-11-16fix an accidental NULL deref introduced last year, found by patrick.Theo de Raadt
rewrite the code with a goto so this never happens again. ok patrick millert
2021-11-16Zero all copies of pre-shared key.Tobias Heider
ok markus@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-07 23:39:31 +0000